<?xml version="1.0" encoding="utf-8"?>
<ds:data-stream-collection xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" xmlns:cpe-dict="http://cpe.mitre.org/dictionary/2.0" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ocil="http://scap.nist.gov/schema/ocil/2.0" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="scap_org.open-scap_collection_from_xccdf_ssg-ol9-xccdf.xml" schematron-version="1.3">
  <ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_ssg-ol9-xccdf.xml" scap-version="1.3" use-case="OTHER">
    <ds:dictionaries>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-ol9-cpe-dictionary.xml" xlink:href="#scap_org.open-scap_comp_ssg-ol9-cpe-dictionary.xml">
        <cat:catalog>
          <cat:uri name="ssg-ol9-cpe-oval.xml" uri="#scap_org.open-scap_cref_ssg-ol9-cpe-oval.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:dictionaries>
    <ds:checklists>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-ol9-xccdf.xml" xlink:href="#scap_org.open-scap_comp_ssg-ol9-xccdf.xml">
        <cat:catalog>
          <cat:uri name="ssg-ol9-oval.xml" uri="#scap_org.open-scap_cref_ssg-ol9-oval.xml"/>
          <cat:uri name="ssg-ol9-ocil.xml" uri="#scap_org.open-scap_cref_ssg-ol9-ocil.xml"/>
          <cat:uri name="ssg-ol9-cpe-oval.xml" uri="#scap_org.open-scap_cref_ssg-ol9-cpe-oval.xml"/>
          <cat:uri name="security-oval-com.oracle.elsa-ol9.xml.bz2" uri="#scap_org.open-scap_cref_security-oval-com.oracle.elsa-ol9.xml.bz2"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:checklists>
    <ds:checks>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-ol9-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-ol9-oval.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-ol9-ocil.xml" xlink:href="#scap_org.open-scap_comp_ssg-ol9-ocil.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-ol9-cpe-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-ol9-cpe-oval.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_security-oval-com.oracle.elsa-ol9.xml.bz2" xlink:href="https://linux.oracle.com/security/oval/com.oracle.elsa-ol9.xml.bz2"/>
    </ds:checks>
  </ds:data-stream>
  <ds:component id="scap_org.open-scap_comp_ssg-ol9-cpe-dictionary.xml" timestamp="2025-05-05T17:00:00">
    <cpe-dict:cpe-list xsi:schemaLocation="http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
      <cpe-dict:cpe-item name="cpe:/o:oracle:linux:9">
        <cpe-dict:title xml:lang="en-us">Oracle Linux 9</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml">oval:ssg-installed_OS_is_ol9:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
    </cpe-dict:cpe-list>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-ol9-xccdf.xml" timestamp="2025-05-05T17:00:00">
    <xccdf-1.2:Benchmark id="xccdf_org.ssgproject.content_benchmark_OL-9" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2 xccdf-1.2.xsd" style="SCAP_1.2" resolved="true" xml:lang="en-US">
      <xccdf-1.2:status date="2025-05-06">draft</xccdf-1.2:status>
      <xccdf-1.2:title>Guide to the Secure Configuration of Oracle Linux 9</xccdf-1.2:title>
      <xccdf-1.2:description>This guide presents a catalog of security-relevant
configuration settings for Oracle Linux 9. It is a rendering of
content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
in order to support security automation.  The SCAP content is
is available in the <html:code>scap-security-guide</html:code> package which is developed at

    <html:a href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>.
<html:br/>
    <html:br/>
Providing system administrators with such guidance informs them how to securely
configure systems under their control in a variety of network roles. Policy
makers and baseline creators can use this catalog of settings, with its
associated references to higher-level security control catalogs, in order to
assist them in security baseline creation. This guide is a <html:em>catalog, not a
checklist</html:em>, and satisfaction of every item is not likely to be possible or
sensible in many operational scenarios. However, the XCCDF format enables
granular selection and adjustment of settings, and their association with OVAL
and OCIL content provides an automated checking capability. Transformations of
this document, and its associated automated checking content, are capable of
providing baselines that meet a diverse set of policy objectives. Some example
XCCDF <html:em>Profiles</html:em>, which are selections of items that form checklists and
can be used as baselines, are available with this guide. They can be
processed, in an automated fashion, with tools that support the Security
Content Automation Protocol (SCAP). The DISA STIG, which provides required
settings for US Department of Defense systems, is one example of a baseline
created from this guidance.
</xccdf-1.2:description>
      <xccdf-1.2:notice id="terms_of_use">Do not attempt to implement any of the settings in
this guide without first testing them in a non-operational environment. The
creators of this guidance assume no responsibility whatsoever for its use by
other parties, and makes no guarantees, expressed or implied, about its
quality, reliability, or any other characteristic.
</xccdf-1.2:notice>
      <xccdf-1.2:front-matter>The SCAP Security Guide Project<html:br/>
    <html:a href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>
   </xccdf-1.2:front-matter>
      <xccdf-1.2:rear-matter>Red Hat and Red Hat Enterprise Linux are either registered
trademarks or trademarks of Red Hat, Inc. in the United States and other
countries. All other names are registered trademarks or trademarks of their
respective companies.</xccdf-1.2:rear-matter>
      <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">anssi</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=application-servers">app-srg</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">app-srg-ctr</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">bsi</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">ccn</xccdf-1.2:reference>
      <xccdf-1.2:reference href="">cis</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">cis-csc</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">cjis</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">cobit5</xccdf-1.2:reference>
      <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">cui</xccdf-1.2:reference>
      <xccdf-1.2:reference href="not_officially_available">dcid</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">disa</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">hipaa</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">isa-62443-2009</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">isa-62443-2013</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">ism</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">iso27001-2013</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">nerc-cip</xccdf-1.2:reference>
      <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">nist</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">nist-csf</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">os-srg</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">ospp</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">pcidss</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">pcidss4</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">stigid</xccdf-1.2:reference>
      <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">stigref</xccdf-1.2:reference>
      <cpe-lang:platform-specification>
        <cpe-lang:platform id="system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_audit">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_audit:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_aarch64_arch">
          <cpe-lang:logical-test operator="AND" negate="true">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_aarch64_arch_and_not_s390x_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1"/>
            </cpe-lang:logical-test>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="aarch64_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="grub2">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_has_grub2_package:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_avahi_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_avahi:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="machine">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_is_a_machine:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_postfix">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_postfix:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="nfs_mount_defined">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-nfs_mount_defined:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_chrony">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_chrony:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_chrony_or_package_ntp">
          <cpe-lang:logical-test operator="OR" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_chrony:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_ntp:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_systemd">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_systemd:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_rsh-server">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_rsh-server:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_telnet-server_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_telnet-server:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_tftp-server">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_tftp-server:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_squid_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_squid:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_runtime_kernel_fips_enabled">
          <cpe-lang:logical-test operator="AND" negate="true">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-runtime_kernel_fips_enabled:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_snmpd_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_snmpd:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_net-snmp">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_net-snmp:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_sssd">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_sssd:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="sssd-ldap">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-sssd_conf_uses_ldap:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_s390x_arch_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_usbguard">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_usbguard:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_gdm">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_gdm:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_pam">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_pam:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_libuser">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_libuser:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_shadow-utils">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_shadow-utils:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_s390x_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="os_linux_ol_gt_or_eq_8_7">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_ol_gt_or_eq_8_7:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="os_linux_rhel_gt_or_eq_8_7_and_os_linux_rhel_ne_9_0">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_rhel_gt_or_eq_8_7:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_rhel_ne_9_0:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_bash">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_bash:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="grub2_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_has_grub2_package:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="non-uefi">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_boot_mode_is_non_uefi:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_bootc">
          <cpe-lang:logical-test operator="AND" negate="true">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-bootc:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="uefi">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_boot_mode_is_uefi:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="x86_64_arch">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_x86_64:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="aarch64_arch_or_x86_64_arch">
          <cpe-lang:logical-test operator="OR" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_x86_64:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_rsyslog">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_rsyslog:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_logrotate">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_logrotate:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="os_linux_ol_gt_or_eq_9_and_package_logrotate">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_ol_gt_or_eq_9:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_logrotate:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_firewalld">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_firewalld:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_libreswan">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_libreswan:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_iptables_and_service_disabled_firewalld_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_iptables:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-service_disabled_firewalld:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_package_nftables_and_not_package_ufw_and_package_iptables">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_nftables:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_ufw:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_iptables:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_iptables">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_iptables:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_package_nftables_and_not_package_ufw">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_nftables:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_ufw:def:1"/>
            </cpe-lang:logical-test>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="ipv6_enabled">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-ipv6_enabled:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_nftables">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_nftables:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="service_disabled_iptables_and_service_disabled_ufw_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-service_disabled_iptables:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-service_disabled_ufw:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_firewalld_and_package_nftables_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_firewalld:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_nftables:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_ufw_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_ufw:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="wifi-iface">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_has_wifi_interface:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_networkmanager">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_networkmanager:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_polkit">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_polkit:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_autofs_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_autofs:def:1"/>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_bootc_and_not_container">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-bootc:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_is_a_container:def:1"/>
            </cpe-lang:logical-test>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_home">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_home:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_opt">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_opt:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_srv">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_srv:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_tmp">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_tmp:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_var-log-audit">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_var-log-audit:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_var-log">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_var-log:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_var">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_var:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="mount_var-tmp">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_mount_var-tmp:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_aarch64_arch_and_not_ppc64le_arch_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_ppc64le:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="selinux">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-selinux_is_enabled:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_bind">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_bind:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_osbuild_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-installed_env_is_osbuild:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_sudo">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_sudo:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_aarch64_arch_and_os_linux_ol_gt_or_eq_9_0_or_aarch64_arch_and_os_linux_rhel_gt_or_eq_9_0_or_os_linux_rhel_le_or_eq_8_4_and_s390x_arch">
          <cpe-lang:logical-test operator="AND" negate="true">
            <cpe-lang:logical-test operator="OR" negate="false">
              <cpe-lang:logical-test operator="AND" negate="false">
                <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
                <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_ol_gt_or_eq_9_0:def:1"/>
              </cpe-lang:logical-test>
              <cpe-lang:logical-test operator="AND" negate="false">
                <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1"/>
                <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_rhel_gt_or_eq_9_0:def:1"/>
              </cpe-lang:logical-test>
              <cpe-lang:logical-test operator="AND" negate="false">
                <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-os_linux_rhel_le_or_eq_8_4:def:1"/>
                <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1"/>
              </cpe-lang:logical-test>
            </cpe-lang:logical-test>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="not_runtime_kernel_fips_enabled_and_system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:logical-test operator="AND" negate="true">
              <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-runtime_kernel_fips_enabled:def:1"/>
            </cpe-lang:logical-test>
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
        <cpe-lang:platform id="package_yum">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ol9-cpe-oval.xml" id-ref="oval:ssg-package_yum:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>
      </cpe-lang:platform-specification>
      <xccdf-1.2:platform idref="cpe:/o:oracle:linux:9"/>
      <xccdf-1.2:version update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.76</xccdf-1.2:version>
      <xccdf-1.2:metadata>
        <dc:publisher>SCAP Security Guide Project</dc:publisher>
        <dc:creator>SCAP Security Guide Project</dc:creator>
        <dc:contributor>Frank J Cameron (CAM1244) &lt;cameron@ctc.com&gt;</dc:contributor>
        <dc:contributor>0x66656c6978 &lt;0x66656c6978@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Håvard F. Aasen &lt;havard.f.aasen@pfft.no&gt;</dc:contributor>
        <dc:contributor>Armando Acosta &lt;armando.acosta@oracle.com&gt;</dc:contributor>
        <dc:contributor>Jack Adolph &lt;jack.adolph@gmail.com&gt;</dc:contributor>
        <dc:contributor>Edgar Aguilar &lt;edgar.aguilar@oracle.com&gt;</dc:contributor>
        <dc:contributor>akuster &lt;akuster808@gmail.com&gt;</dc:contributor>
        <dc:contributor>Gabe Alford &lt;redhatrises@gmail.com&gt;</dc:contributor>
        <dc:contributor>Firas AlShafei &lt;firas.alshafei@us.abb.com&gt;</dc:contributor>
        <dc:contributor>Rodrigo Alvares &lt;ralvares@redhat.com&gt;</dc:contributor>
        <dc:contributor>Christopher Anderson &lt;cba@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor>Craig Andrews &lt;candrews@integralblue.com&gt;</dc:contributor>
        <dc:contributor>angystardust &lt;angystardust@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>anivan-suse &lt;anastasija.ivanovic@suse.com&gt;</dc:contributor>
        <dc:contributor>anixon-rh &lt;55244503+anixon-rh@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Steve Arnold &lt;sarnold@vctlabs.com&gt;</dc:contributor>
        <dc:contributor>Ikko Ashimine &lt;eltociear@gmail.com&gt;</dc:contributor>
        <dc:contributor>Chuck Atkins &lt;chuck.atkins@kitware.com&gt;</dc:contributor>
        <dc:contributor>Bharath B &lt;bhb@redhat.com&gt;</dc:contributor>
        <dc:contributor>Ryan Ballanger &lt;root@rballang-admin-2.fastenal.com&gt;</dc:contributor>
        <dc:contributor>Alex Baranowski &lt;alex@euro-linux.com&gt;</dc:contributor>
        <dc:contributor>Eduardo Barretto &lt;eduardo.barretto@canonical.com&gt;</dc:contributor>
        <dc:contributor>Paul Bastide &lt;pbastide@us.ibm.com&gt;</dc:contributor>
        <dc:contributor>Molly Jo Bault &lt;Molly.Jo.Bault@ballardtech.com&gt;</dc:contributor>
        <dc:contributor>Andrew Becker &lt;A-Beck@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Gabriel Becker &lt;ggasparb@redhat.com&gt;</dc:contributor>
        <dc:contributor>BenGui &lt;benoit.guillon1@etu.unilim.fr&gt;</dc:contributor>
        <dc:contributor>Alexander Bergmann &lt;abergmann@suse.com&gt;</dc:contributor>
        <dc:contributor>Eric Berry &lt;eric@approvedworkman.com&gt;</dc:contributor>
        <dc:contributor>Dale Bewley &lt;dale@bewley.net&gt;</dc:contributor>
        <dc:contributor>Jose Luis BG &lt;bgjoseluis@gmail.com&gt;</dc:contributor>
        <dc:contributor>binyanling &lt;binyanling@uniontech.com&gt;</dc:contributor>
        <dc:contributor>Joseph Bisch &lt;joseph.bisch@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jeff Blank &lt;blank@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Olivier Bonhomme &lt;ptitoliv@ptitoliv.net&gt;</dc:contributor>
        <dc:contributor>Lance Bragstad &lt;lbragstad@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ted Brunell &lt;tbrunell@redhat.com&gt;</dc:contributor>
        <dc:contributor>Marcus Burghardt &lt;maburgha@redhat.com&gt;</dc:contributor>
        <dc:contributor>Matthew Burket &lt;mburket@redhat.com&gt;</dc:contributor>
        <dc:contributor>Blake Burkhart &lt;blake.burkhart@us.af.mil&gt;</dc:contributor>
        <dc:contributor>Patrick Callahan &lt;pmc@patrickcallahan.com&gt;</dc:contributor>
        <dc:contributor>George Campbell &lt;gcampbell@palantir.com&gt;</dc:contributor>
        <dc:contributor>Nick Carboni &lt;ncarboni@redhat.com&gt;</dc:contributor>
        <dc:contributor>Carlos &lt;64919342+carlosmmatos@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>James Cassell &lt;james.cassell@ll.mit.edu&gt;</dc:contributor>
        <dc:contributor>Frank Caviggia &lt;fcaviggia@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Eric Christensen &lt;echriste@redhat.com&gt;</dc:contributor>
        <dc:contributor>Dan Clark &lt;danclark@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jayson Cofell &lt;1051437+70k10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>David du Colombier &lt;djc@datadoghq.com&gt;</dc:contributor>
        <dc:contributor>Commandcracker &lt;lukas.fricke.dev@gmail.com&gt;</dc:contributor>
        <dc:contributor>Caleb Cooper &lt;coopercd@ornl.gov&gt;</dc:contributor>
        <dc:contributor>CoreyCook8 &lt;129206271+CoreyCook8@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>cortesana &lt;acortes@redhat.com&gt;</dc:contributor>
        <dc:contributor>Richard Maciel Costa &lt;richard.maciel.costa@canonical.com&gt;</dc:contributor>
        <dc:contributor>Xavier Coulon &lt;xavier.coulon@suse.com&gt;</dc:contributor>
        <dc:contributor>Deric Crago &lt;deric.crago@gmail.com&gt;</dc:contributor>
        <dc:contributor>crleekwc &lt;crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor>cueball23 &lt;christoph.alms@westnetz.de&gt;</dc:contributor>
        <dc:contributor>cyarbrough76 &lt;42849651+cyarbrough76@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Maura Dailey &lt;maura@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Klaas Demter &lt;demter@atix.de&gt;</dc:contributor>
        <dc:contributor>denknorr &lt;dennis.knorr@suse.com&gt;</dc:contributor>
        <dc:contributor>dependabot[bot] &lt;49699333+dependabot[bot]@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>dhanushkar-wso2 &lt;dhanushkar@wso2.com&gt;</dc:contributor>
        <dc:contributor>Andrew DiPrinzio &lt;andrew.diprinzio@jhuapl.edu&gt;</dc:contributor>
        <dc:contributor>dom &lt;dominique.blaze@devinci.fr&gt;</dc:contributor>
        <dc:contributor>Jean-Baptiste Donnette &lt;jean-baptiste.donnette@epita.fr&gt;</dc:contributor>
        <dc:contributor>Marco De Donno &lt;mdedonno1337@gmail.com&gt;</dc:contributor>
        <dc:contributor>dperrone &lt;dperrone@redhat.com&gt;</dc:contributor>
        <dc:contributor>drax &lt;applezip@gmail.com&gt;</dc:contributor>
        <dc:contributor>Sebastian Dunne &lt;sdunne@redhat.com&gt;</dc:contributor>
        <dc:contributor>François Duthilleul &lt;francoisduthilleul@gmail.com&gt;</dc:contributor>
        <dc:contributor>Greg Elin &lt;gregelin@gitmachines.com&gt;</dc:contributor>
        <dc:contributor>eradot4027 &lt;jrtonmac@gmail.com&gt;</dc:contributor>
        <dc:contributor>ermeratos &lt;manuel.ermer@eviden.net&gt;</dc:contributor>
        <dc:contributor>Alexis Facques &lt;alexis.facques@mythalesgroup.io&gt;</dc:contributor>
        <dc:contributor>Henry Finucane &lt;hfinucane@zscaler.com&gt;</dc:contributor>
        <dc:contributor>Leah Fisher &lt;lfisher047@gmail.com&gt;</dc:contributor>
        <dc:contributor>Marco Fortina &lt;marco_fortina@hotmail.it&gt;</dc:contributor>
        <dc:contributor>Yavor Georgiev &lt;strandjata@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alijohn Ghassemlouei &lt;alijohn@secureagc.com&gt;</dc:contributor>
        <dc:contributor>Swarup Ghosh &lt;swghosh@redhat.com&gt;</dc:contributor>
        <dc:contributor>ghylock &lt;ghylock@gmail.com&gt;</dc:contributor>
        <dc:contributor>Andrew Gilmore &lt;agilmore2@gmail.com&gt;</dc:contributor>
        <dc:contributor>Joshua Glemza &lt;jglemza@nasa.gov&gt;</dc:contributor>
        <dc:contributor>Nick Gompper &lt;forestgomp@yahoo.com&gt;</dc:contributor>
        <dc:contributor>David Fernandez Gonzalez &lt;david.fernandezgonzalez@canonical.com&gt;</dc:contributor>
        <dc:contributor>Loren Gordon &lt;lorengordon@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Gene Gotimer &lt;otherdevopsgene@portinfo.com&gt;</dc:contributor>
        <dc:contributor>Patrik Greco &lt;sikevux@sikevux.se&gt;</dc:contributor>
        <dc:contributor>Steve Grubb &lt;sgrubb@redhat.com&gt;</dc:contributor>
        <dc:contributor>guangyee &lt;gyee@suse.com&gt;</dc:contributor>
        <dc:contributor>Christian Hagenest &lt;christian.hagenest@suse.com&gt;</dc:contributor>
        <dc:contributor>Marek Haicman &lt;mhaicman@redhat.com&gt;</dc:contributor>
        <dc:contributor>Vern Hart &lt;vern.hart@canonical.com&gt;</dc:contributor>
        <dc:contributor>Alex Haydock &lt;alex@alexhaydock.co.uk&gt;</dc:contributor>
        <dc:contributor>Rebekah Hayes &lt;rhayes@corp.rivierautilities.com&gt;</dc:contributor>
        <dc:contributor>Trey Henefield &lt;thenefield@gmail.com&gt;</dc:contributor>
        <dc:contributor>Henning Henkel &lt;henning.henkel@helvetia.ch&gt;</dc:contributor>
        <dc:contributor>hex2a &lt;hex2a@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>hipponix &lt;mirco.santori@gmail.com&gt;</dc:contributor>
        <dc:contributor>John Hooks &lt;jhooks@starscream.pa.jhbcomputers.com&gt;</dc:contributor>
        <dc:contributor>Jakub Hrozek &lt;jhrozek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Donald Hunter &lt;donald.hunter@gmail.com&gt;</dc:contributor>
        <dc:contributor>De Huo &lt;De.Huo@windriver.com&gt;</dc:contributor>
        <dc:contributor>Robin Price II &lt;robin@redhat.com&gt;</dc:contributor>
        <dc:contributor>Yasir Imam &lt;yimam@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jiri Jaburek &lt;jjaburek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Keith Jackson &lt;keithkjackson@gmail.com&gt;</dc:contributor>
        <dc:contributor>Marc Jadoul &lt;mgjadoul@laptomatic.auth-o-matic.corp&gt;</dc:contributor>
        <dc:contributor>Jeremiah Jahn &lt;jeremiah@goodinassociates.com&gt;</dc:contributor>
        <dc:contributor>Jakub Jelen &lt;jjelen@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jessicahfy &lt;Jessicahfy@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Stephan Joerrens &lt;Stephan.Joerrens@fiduciagad.de&gt;</dc:contributor>
        <dc:contributor>Simon John &lt;sjohn@tuxcare.com&gt;</dc:contributor>
        <dc:contributor>Hunter Jones &lt;hjones2199@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jono &lt;jono@ubuntu-18.localdomain&gt;</dc:contributor>
        <dc:contributor>justchris1 &lt;justchris1@justchris1.email&gt;</dc:contributor>
        <dc:contributor>Kacper &lt;kacper@kacper.se&gt;</dc:contributor>
        <dc:contributor>Kai Kang &lt;kai.kang@windriver.com&gt;</dc:contributor>
        <dc:contributor>Charles Kernstock &lt;charles.kernstock@ultra-ats.com&gt;</dc:contributor>
        <dc:contributor>Yuli Khodorkovskiy &lt;ykhodorkovskiy@tresys.com&gt;</dc:contributor>
        <dc:contributor>Sherine Khoury &lt;skhoury@redhat.com&gt;</dc:contributor>
        <dc:contributor>Nathan Kinder &lt;nkinder@redhat.com&gt;</dc:contributor>
        <dc:contributor>Lee Kinser &lt;lee.kinser@gmail.com&gt;</dc:contributor>
        <dc:contributor>Evgeny Kolesnikov &lt;ekolesni@redhat.com&gt;</dc:contributor>
        <dc:contributor>Peter 'Pessoft' Kolínek &lt;github@pessoft.com&gt;</dc:contributor>
        <dc:contributor>Luke Kordell &lt;luke.t.kordell@lmco.com&gt;</dc:contributor>
        <dc:contributor>Malte Kraus &lt;malte.kraus@suse.com&gt;</dc:contributor>
        <dc:contributor>Seth Kress &lt;seth.kress@dsainc.com&gt;</dc:contributor>
        <dc:contributor>Felix Krohn &lt;felix.krohn@helvetia.ch&gt;</dc:contributor>
        <dc:contributor>kspargur &lt;kspargur@kspargur.csb&gt;</dc:contributor>
        <dc:contributor>Amit Kumar &lt;amitkuma@redhat.com&gt;</dc:contributor>
        <dc:contributor>Fen Labalme &lt;fen@civicactions.com&gt;</dc:contributor>
        <dc:contributor>Dexter Le &lt;dexter.le@sap.com&gt;</dc:contributor>
        <dc:contributor>Ade Lee &lt;alee@redhat.com&gt;</dc:contributor>
        <dc:contributor>Christopher Lee &lt;Crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ian Lee &lt;lee1001@llnl.gov&gt;</dc:contributor>
        <dc:contributor>Jarrett Lee &lt;jarrettl@umd.edu&gt;</dc:contributor>
        <dc:contributor>Joseph Lenox &lt;joseph.lenox@collins.com&gt;</dc:contributor>
        <dc:contributor>lichtblaugue &lt;guenther.lichtblau@eviden.com&gt;</dc:contributor>
        <dc:contributor>Jan Lieskovsky &lt;jlieskov@redhat.com&gt;</dc:contributor>
        <dc:contributor>Markus Linnala &lt;Markus.Linnala@knowit.fi&gt;</dc:contributor>
        <dc:contributor>Flos Lonicerae &lt;lonicerae@gmail.com&gt;</dc:contributor>
        <dc:contributor>Simon Lukasik &lt;slukasik@redhat.com&gt;</dc:contributor>
        <dc:contributor>Milan Lysonek &lt;mlysonek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Fredrik Lysén &lt;fredrik@pipemore.se&gt;</dc:contributor>
        <dc:contributor>Mab879 &lt;207087+Mab879@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Mackemania &lt;8738793+Mackemania@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Caitlin Macleod &lt;caitelatte@gmail.com&gt;</dc:contributor>
        <dc:contributor>Dmitry Makovey &lt;dmakovey@yahoo.com&gt;</dc:contributor>
        <dc:contributor>Nick Maludy &lt;nmaludy@gmail.com&gt;</dc:contributor>
        <dc:contributor>Lokesh Mandvekar &lt;lsm5@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor>Matus Marhefka &lt;mmarhefk@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jamie Lorwey Martin &lt;jlmartin@redhat.com&gt;</dc:contributor>
        <dc:contributor>Carlos Matos &lt;cmatos@redhat.com&gt;</dc:contributor>
        <dc:contributor>Robert McAllister &lt;rmcallis@redhat.com&gt;</dc:contributor>
        <dc:contributor>Karen McCarron &lt;kmccarro@redhat.com&gt;</dc:contributor>
        <dc:contributor>Michael McConachie &lt;michael@redhat.com&gt;</dc:contributor>
        <dc:contributor>Marcus Meissner &lt;meissner@suse.de&gt;</dc:contributor>
        <dc:contributor>Khary Mendez &lt;kmendez@redhat.com&gt;</dc:contributor>
        <dc:contributor>Rodney Mercer &lt;rmercer@harris.com&gt;</dc:contributor>
        <dc:contributor>Matt Micene &lt;nzwulfin@gmail.com&gt;</dc:contributor>
        <dc:contributor>Brian Millett &lt;bmillett@gmail.com&gt;</dc:contributor>
        <dc:contributor>Takuya Mishina &lt;tmishina@jp.ibm.com&gt;</dc:contributor>
        <dc:contributor>Mixer9 &lt;35545791+Mixer9@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>mmosel &lt;mmosel@kde.example.com&gt;</dc:contributor>
        <dc:contributor>Thomas Montague &lt;montague.thomas@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alan Moore &lt;alan.moore@canonical.com&gt;</dc:contributor>
        <dc:contributor>Zbynek Moravec &lt;zmoravec@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kazuo Moriwaka &lt;moriwaka@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Michael Moseley &lt;michael@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Nathan Moyer &lt;nmoyer@spectric.com&gt;</dc:contributor>
        <dc:contributor>Ross Murphy &lt;RossMurphy@ibm.com&gt;</dc:contributor>
        <dc:contributor>Renaud Métrich &lt;rmetrich@redhat.com&gt;</dc:contributor>
        <dc:contributor>Joe Nall &lt;joe@nall.com&gt;</dc:contributor>
        <dc:contributor>namoyer10 &lt;48189779+namoyer10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Neiloy &lt;neiloy@redhat.com&gt;</dc:contributor>
        <dc:contributor>Axel Nennker &lt;axel@nennker.de&gt;</dc:contributor>
        <dc:contributor>Michele Newman &lt;mnewman@redhat.com&gt;</dc:contributor>
        <dc:contributor>nnerdmann &lt;128606223+nnerdmann@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Sean O'Keeffe &lt;seanokeeffe797@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jiri Odehnal &lt;jodehnal@redhat.com&gt;</dc:contributor>
        <dc:contributor>Ilya Okomin &lt;ilya.okomin@oracle.com&gt;</dc:contributor>
        <dc:contributor>Kaustubh Padegaonkar &lt;theTuxRacer@gmail.com&gt;</dc:contributor>
        <dc:contributor>Michael Palmiotto &lt;mpalmiotto@tresys.com&gt;</dc:contributor>
        <dc:contributor>Eryx Paredes &lt;eryxp@lyft.com&gt;</dc:contributor>
        <dc:contributor>Max R.D. Parmer &lt;maxp@trystero.is&gt;</dc:contributor>
        <dc:contributor>Arnaud Patard &lt;apatard@hupstream.com&gt;</dc:contributor>
        <dc:contributor>Jan Pazdziora &lt;jpazdziora@redhat.com&gt;</dc:contributor>
        <dc:contributor>pcactr &lt;paul.c.arnold4.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor>Kenneth Peeples &lt;kennethwpeeples@gmail.com&gt;</dc:contributor>
        <dc:contributor>Nathan Peters &lt;Nathaniel.Peters@ca.com&gt;</dc:contributor>
        <dc:contributor>Frank Lin PIAT &lt;fpiat@klabs.be&gt;</dc:contributor>
        <dc:contributor>Stefan Pietsch &lt;mail.ipv4v6+gh@gmail.com&gt;</dc:contributor>
        <dc:contributor>piggyvenus &lt;piggyvenus@gmail.com&gt;</dc:contributor>
        <dc:contributor>Vojtech Polasek &lt;vpolasek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Orion Poplawski &lt;orion@nwra.com&gt;</dc:contributor>
        <dc:contributor>Jennifer Power &lt;barnabei.jennifer@gmail.com&gt;</dc:contributor>
        <dc:contributor>Nick Poyant &lt;npoyant@redhat.com&gt;</dc:contributor>
        <dc:contributor>Martin Preisler &lt;mpreisle@redhat.com&gt;</dc:contributor>
        <dc:contributor>Wesley Ceraso Prudencio &lt;wcerasop@redhat.com&gt;</dc:contributor>
        <dc:contributor>Raphael Sanchez Prudencio &lt;rsprudencio@redhat.com&gt;</dc:contributor>
        <dc:contributor>Miha Purg &lt;miha.purg@canonical.com&gt;</dc:contributor>
        <dc:contributor>T.O. Radzy Radzykewycz &lt;radzy@windriver.com&gt;</dc:contributor>
        <dc:contributor>rain-Qing &lt;yangyuqing6@qq.com&gt;</dc:contributor>
        <dc:contributor>Kenyon Ralph &lt;kenyon@kenyonralph.com&gt;</dc:contributor>
        <dc:contributor>Mike Ralph &lt;mralph@redhat.com&gt;</dc:contributor>
        <dc:contributor>Federico Ramirez &lt;federico.r.ramirez@oracle.com&gt;</dc:contributor>
        <dc:contributor>rchikov &lt;rumen.chikov@suse.com&gt;</dc:contributor>
        <dc:contributor>Rick Renshaw &lt;Richard_Renshaw@xtoenergy.com&gt;</dc:contributor>
        <dc:contributor>Paul Rensing &lt;prensing@cimetrics.com&gt;</dc:contributor>
        <dc:contributor>Chris Reynolds &lt;c.reynolds82@gmail.com&gt;</dc:contributor>
        <dc:contributor>rhayes &lt;rhayes@rivierautilities.com&gt;</dc:contributor>
        <dc:contributor>Pat Riehecky &lt;riehecky@fnal.gov&gt;</dc:contributor>
        <dc:contributor>rlucente-se-jboss &lt;rlucente@redhat.com&gt;</dc:contributor>
        <dc:contributor>Juan Antonio Osorio Robles &lt;juan.osoriorobles@eu.equinix.com&gt;</dc:contributor>
        <dc:contributor>Paul Roche &lt;paul.roche@menlosecurity.com&gt;</dc:contributor>
        <dc:contributor>Jan Rodak &lt;hony.com@seznam.cz&gt;</dc:contributor>
        <dc:contributor>Matt Rogers &lt;mrogers@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jesse Roland &lt;jesse.roland@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>Joshua Roys &lt;roysjosh@gmail.com&gt;</dc:contributor>
        <dc:contributor>rrenshaw &lt;bofh69@yahoo.com&gt;</dc:contributor>
        <dc:contributor>Chris Ruffalo &lt;chris.ruffalo@gmail.com&gt;</dc:contributor>
        <dc:contributor>Benjamin Ruland &lt;benjamin.ruland@gmail.com&gt;</dc:contributor>
        <dc:contributor>rumch-se &lt;77793453+rumch-se@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Rutvik &lt;rutksh@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ray Shaw (Cont ARL/CISD) rvshaw &lt;rvshaw@esme.arl.army.mil&gt;</dc:contributor>
        <dc:contributor>Nicolas SAID &lt;nicolas.said@atos.net&gt;</dc:contributor>
        <dc:contributor>Earl Sampson &lt;ESampson@suse.com&gt;</dc:contributor>
        <dc:contributor>sampsone &lt;esampson@suse.com&gt;</dc:contributor>
        <dc:contributor>Mirco Santori &lt;mirco.santori@roche.com&gt;</dc:contributor>
        <dc:contributor>Willy Santos &lt;wsantos@redhat.com&gt;</dc:contributor>
        <dc:contributor>Nagarjuna Sarvepalli &lt;snagarju@redhat.com&gt;</dc:contributor>
        <dc:contributor>Anderson Sasaki &lt;33833274+ansasaki@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Gautam Satish &lt;gautams@hpe.com&gt;</dc:contributor>
        <dc:contributor>Watson Sato &lt;wsato@redhat.com&gt;</dc:contributor>
        <dc:contributor>Satoru SATOH &lt;satoru.satoh@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alexander Scheel &lt;alexander.m.scheel@gmail.com&gt;</dc:contributor>
        <dc:contributor>Bryan Schneiders &lt;pschneiders@trisept.com&gt;</dc:contributor>
        <dc:contributor>Robert Schweikert &lt;rjschwei@suse.com&gt;</dc:contributor>
        <dc:contributor>shaneboulden &lt;shane.boulden@gmail.com&gt;</dc:contributor>
        <dc:contributor>Vincent Shen &lt;wenshen@redhat.com&gt;</dc:contributor>
        <dc:contributor>Dhriti Shikhar &lt;dhriti.shikhar.rokz@gmail.com&gt;</dc:contributor>
        <dc:contributor>Spencer Shimko &lt;sshimko@tresys.com&gt;</dc:contributor>
        <dc:contributor>Mark Shoger &lt;mshoger@redhat.com&gt;</dc:contributor>
        <dc:contributor>Shane Siebken &lt;shane.siebken@capellaspace.com&gt;</dc:contributor>
        <dc:contributor>THOBY Simon &lt;Simon.THOBY@viveris.fr&gt;</dc:contributor>
        <dc:contributor>Thomas Sjögren &lt;konstruktoid@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Jindrich Skacel &lt;102800748+jskacel@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Alexandre Skrzyniarz &lt;alexandre.skrzyniarz@laposte.net&gt;</dc:contributor>
        <dc:contributor>Francisco Slavin &lt;fslavin@tresys.com&gt;</dc:contributor>
        <dc:contributor>sluetze &lt;13255307+sluetze@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Dave Smith &lt;dsmith@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>David Smith &lt;dsmith@fornax.eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Kevin Spargur &lt;kspargur@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kenneth Stailey &lt;kstailey.lists@gmail.com&gt;</dc:contributor>
        <dc:contributor>Leland Steinke &lt;leland.j.steinke.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor>Justin Stephenson &lt;jstephen@redhat.com&gt;</dc:contributor>
        <dc:contributor>steven.y.gui &lt;steven_ygui@163.com&gt;</dc:contributor>
        <dc:contributor>Brian Stinson &lt;brian@bstinson.com&gt;</dc:contributor>
        <dc:contributor>Jake Stookey &lt;jakestookey@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jonathan Sturges &lt;jsturges@redhat.com&gt;</dc:contributor>
        <dc:contributor>svet-se &lt;svetlin.boychev@suse.com&gt;</dc:contributor>
        <dc:contributor>teacup-on-rockingchair &lt;315160+teacup-on-rockingchair@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Ian Tewksbury &lt;itewk@redhat.com&gt;</dc:contributor>
        <dc:contributor>Philippe Thierry &lt;phil@reseau-libre.net&gt;</dc:contributor>
        <dc:contributor>Simon THOBY &lt;git@nightmared.fr&gt;</dc:contributor>
        <dc:contributor>Derek Thurston &lt;thegrit@gmail.com&gt;</dc:contributor>
        <dc:contributor>tianzhenjia &lt;jiatianzhen@cmss.chinamobile.com&gt;</dc:contributor>
        <dc:contributor>Greg Tinsley &lt;gtinsley@redhat.com&gt;</dc:contributor>
        <dc:contributor>Paul Tittle &lt;ptittle@cmf.nrl.navy.mil&gt;</dc:contributor>
        <dc:contributor>tom &lt;tom@localhost.localdomain&gt;</dc:contributor>
        <dc:contributor>tomas.hudik &lt;tomas.hudik@embedit.cz&gt;</dc:contributor>
        <dc:contributor>Jeb Trayer &lt;jeb.d.trayer@uscg.mil&gt;</dc:contributor>
        <dc:contributor>TrilokGeer &lt;tgeer@redhat.com&gt;</dc:contributor>
        <dc:contributor>Viktors Trubovics &lt;viktors.trubovics@suse.com&gt;</dc:contributor>
        <dc:contributor>Nico Truzzolino &lt;nico.truzzolino@gmx.de&gt;</dc:contributor>
        <dc:contributor>Brian Turek &lt;brian.turek@gmail.com&gt;</dc:contributor>
        <dc:contributor>Matěj Týč &lt;matyc@redhat.com&gt;</dc:contributor>
        <dc:contributor>VadimDor &lt;29509093+VadimDor@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Trevor Vaughan &lt;tvaughan@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>vtrubovics &lt;82443408+vtrubovics@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Samuel Warren &lt;swarren@redhat.com&gt;</dc:contributor>
        <dc:contributor>wcushen &lt;54533890+wcushen@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Shawn Wells &lt;shawn@redhat.com&gt;</dc:contributor>
        <dc:contributor>Whidix &lt;31294015+Whidix@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Daniel E. White &lt;linuxdan@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Bernhard M. Wiedemann &lt;bwiedemann@suse.de&gt;</dc:contributor>
        <dc:contributor>Roy Williams &lt;roywilli@roywilli.redhat.com&gt;</dc:contributor>
        <dc:contributor>Willumpie &lt;willumpie@xs4all.nl&gt;</dc:contributor>
        <dc:contributor>Rob Wilmoth &lt;rwilmoth@redhat.com&gt;</dc:contributor>
        <dc:contributor>win97pro &lt;win97pro@protonmail.com&gt;</dc:contributor>
        <dc:contributor>xcfxr &lt;xucee@qq.com&gt;</dc:contributor>
        <dc:contributor>Lucas Yamanishi &lt;lucas.yamanishi@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>Xirui Yang &lt;xirui.yang@oracle.com&gt;</dc:contributor>
        <dc:contributor>Yuqing Yang &lt;yyq01323329@alibaba-inc.com&gt;</dc:contributor>
        <dc:contributor>yarunachalam &lt;yarunachalam@suse.com&gt;</dc:contributor>
        <dc:contributor>Guang Yee &lt;guang.yee@suse.com&gt;</dc:contributor>
        <dc:contributor>Achilleas John Yfantis &lt;ayfantis@redhat.com&gt;</dc:contributor>
        <dc:contributor>YiLin.Li &lt;YiLin.Li@linux.alibaba.com&gt;</dc:contributor>
        <dc:contributor>yunimoo &lt;yunimoo@nekocake.cafe&gt;</dc:contributor>
        <dc:contributor>YuQing &lt;yyq0391@163.com&gt;</dc:contributor>
        <dc:contributor>zhaoyun &lt;zhaoyun@kylinos.cn&gt;</dc:contributor>
        <dc:contributor>Kevin Zimmerman &lt;kevin.zimmerman@kitware.com&gt;</dc:contributor>
        <dc:contributor>Luigi Mario Zuccarelli &lt;luzuccar@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jan Černý &lt;jcerny@redhat.com&gt;</dc:contributor>
        <dc:contributor>Michal Šrubař &lt;msrubar@redhat.com&gt;</dc:contributor>
        <dc:source>https://github.com/ComplianceAsCode/content/releases/latest</dc:source>
      </xccdf-1.2:metadata>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_stig">
        <xccdf-1.2:version>V1R1</xccdf-1.2:version>
        <xccdf-1.2:title override="true">DISA STIG for Oracle Linux 9</xccdf-1.2:title>
        <xccdf-1.2:description override="true">This profile contains configuration checks that align to the
DISA STIG for Oracle Linux 9 V1R1.</xccdf-1.2:description>
        <xccdf-1.2:reference>https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux</xccdf-1.2:reference>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_temp_expire_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_unique_id" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_authorized_local_users" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_interactive_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_home_paths_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_poweroff" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_reboot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_shutdown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable_login_uids" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postdrop" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postqueue" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_agent" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_update" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sudoers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_system_shutdown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_sufficiently_large_partition" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_freq" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_overflow_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_server_directive" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_clean_components_post_updating" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_firewalld_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_users_coredumps" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disallow_bypass_password_sudo" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_authselect" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_encrypt_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_oracle_gpgkey_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_audit_tools_ownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_audit_tools_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_auditd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_rulesd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_sshd_50_redhat_exists" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_firewalld-backend" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_group_unique_id" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_admin_username" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_password" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_install_smartcard_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_network_configure_name_resolution" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_networkmanager_dns_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_host_based_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_user_host_based_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_audit_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_chrony_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_crypto-policies_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_iprutils_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_openssh-clients_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_policycoreutils-python-utils_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_quagga_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsh-server_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_s-nail_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_tuned_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_usbguard_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias_postmaster" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_autofs_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_fapolicyd_enabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_kdump_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_sshd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ssh_keys_passphrase_protected" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_compression" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_pam" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_pubkey_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_print_last_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_use_strong_macs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_certificate_verification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_certmap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_restrict_privilege_elevation_to_authorized" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_tftpd_uses_secure_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_usbguard_generate_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_xwindows_remove_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_xwindows_runlevel_target" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_cyrus-imapd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gcc_plugin" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kernel_build_config" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-nftables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ufw" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" selector="sha512"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="fips"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" selector="halt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_freq" selector="100"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" selector="root"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_name_format" selector="stig"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" selector="rotate"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" selector="email"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" selector="25pc"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" selector="halt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" selector="halt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" selector="sha512"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" selector="cac"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" selector="SHA512"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" selector="8"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" selector="5000"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" selector="always_prompt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" selector="10"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="15_min"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex" selector="ol9"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="35"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="077"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="60"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="dod_default"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="10_minutes"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" selector="1G"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" selector="1hour"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_strong_macs" selector="stig_ol9"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" selector="stig_ol9"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" selector="no"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_networkmanager_dns_mode" selector="none"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="stig"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" selector="system_default"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_authselect_profile" selector="sssd"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_stig_gui">
        <xccdf-1.2:version>V1R1</xccdf-1.2:version>
        <xccdf-1.2:title override="true">DISA STIG with GUI for Oracle Linux 9</xccdf-1.2:title>
        <xccdf-1.2:description override="true">This profile contains configuration checks that align to the
DISA STIG for Oracle Linux 9 V1R1.

Warning: The installation and use of a Graphical User Interface (GUI)
increases your attack vector and decreases your overall security posture. If
your Information Systems Security Officer (ISSO) lacks a documented operational
requirement for a graphical user interface, please consider using the
standard DISA STIG for Oracle Linux 9 profile.</xccdf-1.2:description>
        <xccdf-1.2:reference>https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux</xccdf-1.2:reference>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_temp_expire_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_unique_id" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_authorized_local_users" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_interactive_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_home_paths_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_poweroff" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_reboot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_privileged_commands_shutdown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable_login_uids" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postdrop" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postqueue" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_agent" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_update" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sudoers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_system_shutdown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_sufficiently_large_partition" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_freq" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_overflow_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_server_directive" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_clean_components_post_updating" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_firewalld_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_users_coredumps" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disallow_bypass_password_sudo" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_authselect" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_encrypt_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_oracle_gpgkey_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_audit_tools_ownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_audit_tools_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_auditd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_rulesd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_sshd_50_redhat_exists" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_firewalld-backend" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_group_unique_id" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_admin_username" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_password" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_install_smartcard_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_network_configure_name_resolution" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_networkmanager_dns_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_host_based_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_user_host_based_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_audit_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_chrony_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_crypto-policies_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_iprutils_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_openssh-clients_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_policycoreutils-python-utils_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_quagga_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsh-server_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_s-nail_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_tuned_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_usbguard_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias_postmaster" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_autofs_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_fapolicyd_enabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_kdump_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_sshd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ssh_keys_passphrase_protected" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_compression" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_pam" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_pubkey_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_print_last_log" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_use_strong_macs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_certificate_verification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_certmap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudo_restrict_privilege_elevation_to_authorized" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_tftpd_uses_secure_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_usbguard_generate_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_cyrus-imapd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gcc_plugin" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kernel_build_config" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-nftables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ufw" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" selector="sha512"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="fips"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" selector="halt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_freq" selector="100"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" selector="root"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_name_format" selector="stig"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" selector="rotate"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" selector="email"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" selector="25pc"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" selector="halt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" selector="halt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" selector="sha512"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" selector="cac"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" selector="SHA512"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" selector="8"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" selector="5000"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" selector="always_prompt"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" selector="10"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="15_min"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex" selector="ol9"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="35"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="077"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="60"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="dod_default"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="10_minutes"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" selector="1G"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" selector="1hour"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_strong_macs" selector="stig_ol9"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" selector="stig_ol9"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" selector="no"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_networkmanager_dns_mode" selector="none"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="stig"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" selector="system_default"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_authselect_profile" selector="sssd"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_system">
        <xccdf-1.2:title>System Settings</xccdf-1.2:title>
        <xccdf-1.2:description>Contains rules that check correct system settings.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_software">
          <xccdf-1.2:title>Installing and Maintaining Software</xccdf-1.2:title>
          <xccdf-1.2:description>The following sections contain information on
security-relevant choices during the initial operating system
installation process and the setup of software
updates.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_prefer_64bit_os" severity="medium">
            <xccdf-1.2:title>Prefer to use a 64-bit Operating System when supported</xccdf-1.2:title>
            <xccdf-1.2:description>Prefer installation of 64-bit operating systems when the CPU supports it.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation besides installing a 64-bit operating system.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R1</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Use of a 64-bit operating system offers a few advantages, like a larger address space range for
Address Space Layout Randomization (ASLR) and systematic presence of No eXecute and Execute Disable (NX/XD) protection bits.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-prefer_64bit_os:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-prefer_64bit_os_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_integrity">
            <xccdf-1.2:title>System and Software Integrity</xccdf-1.2:title>
            <xccdf-1.2:description>System and software integrity can be gained by installing antivirus, increasing
system encryption strength with FIPS, verifying installed software, enabling SELinux,
installing an Intrusion Prevention System, etc. However, installing or enabling integrity
checking tools cannot <html:i>prevent</html:i> intrusions, but they can detect that an intrusion
may have occurred. Requirements for integrity checking may be highly dependent on
the environment in which the system will be used. Snapshot-based approaches such
as AIDE may induce considerable overhead in the presence of frequent software updates.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_software-integrity">
              <xccdf-1.2:title>Software Integrity Checking</xccdf-1.2:title>
              <xccdf-1.2:description>Both the AIDE (Advanced Intrusion Detection Environment)
software and the RPM package management system provide
mechanisms for verifying the integrity of installed software.
AIDE uses snapshots of file metadata (such as hashes) and compares these
to current system files in order to detect changes.
<html:br/>
        <html:br/>
The RPM package management system can conduct integrity
checks by comparing information in its metadata database with
files installed on the system.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email" type="string" interactive="true">
                <xccdf-1.2:title>Integrity Scan Notification Email Address</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the email address for designated personnel if baseline
configurations are changed in an unauthorized manner.</xccdf-1.2:description>
                <xccdf-1.2:value>root@localhost</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rpm_verification">
                <xccdf-1.2:title>Verify Integrity with RPM</xccdf-1.2:title>
                <xccdf-1.2:description>The RPM package management system includes the ability
to verify the integrity of installed packages by comparing the
installed files with information about the files taken from the
package metadata stored in the RPM database. Although an attacker
could corrupt the RPM database (analogous to attacking the AIDE
database as described above), this check can still reveal
modification of important files. To list which files on the system differ from what is expected by the RPM database:
<html:pre>$ rpm -qVa</html:pre>
See the man page for <html:code>rpm</html:code> to see a complete explanation of each column.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="#not_bootc"/>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" severity="high">
                  <xccdf-1.2:title>Verify File Hashes with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description>Without cryptographic integrity protections, system executables and files can be altered by
unauthorized users without detection. The RPM package management system can check the hashes
of installed software packages, including many that are important to system security.

To verify that the cryptographic hash of system files and commands matches vendor values, run
the following command to list which files on the system have hashes that differ from what is
expected by the RPM database:
<html:pre>$ rpm -Va --noconfig | grep '^..5'</html:pre>

If the file was not expected to change, investigate the cause of the change using audit logs
or other means. The package can then be reinstalled to restore the file. Run the following
command to determine which package owns the file:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i>
          </html:pre>

The package can be reinstalled from a yum repository using the command:
<html:pre>$ sudo yum reinstall <html:i>PACKAGENAME</html:i>
          </html:pre>

Alternatively, the package can be reinstalled from trusted media using the command:
<html:pre>$ sudo rpm -Uvh <html:i>PACKAGENAME</html:i>
          </html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of packages present on the system. It is not a
problem in most cases, but especially systems with a large number of installed packages
can be affected.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000243</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271480r1091152_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The hashes of important files like system executables should match the
information given by the RPM database. Executables with erroneous hashes could
be a sign of nefarious activity on the system.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rpm_verify_hashes"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"

if [ -n "$files_with_incorrect_hash" ]; then
    # From files names get package names and change newline to space, because rpm writes each package to new line
    packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"

    
    yum reinstall -y $packages_to_reinstall
    
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rpm_verify_hashes" complexity="high" disruption="medium" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000243
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_hashes

- name: 'Set fact: Package manager reinstall command'
  set_fact:
    package_manager_reinstall_cmd: yum reinstall -y
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - ansible_distribution in [ "Fedora", "RedHat", "CentOS", "OracleLinux" ]
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000243
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_hashes

- name: 'Set fact: Package manager reinstall command (zypper)'
  set_fact:
    package_manager_reinstall_cmd: zypper in -f -y
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - ansible_distribution == "SLES"
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000243
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_hashes

- name: Read files with incorrect hash
  command: rpm -Va --nodeps --nosize --nomtime --nordev --nocaps --nolinkto --nouser
    --nogroup --nomode --noghost --noconfig
  register: files_with_incorrect_hash
  changed_when: false
  failed_when: files_with_incorrect_hash.rc &gt; 1
  check_mode: false
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - (package_manager_reinstall_cmd is defined)
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000243
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_hashes

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  with_items: '{{ files_with_incorrect_hash.stdout_lines | map(''regex_findall'',
    ''^[.]+[5]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - files_with_incorrect_hash.stdout_lines is defined
  - (files_with_incorrect_hash.stdout_lines | length &gt; 0)
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000243
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_hashes

- name: Reinstall packages of files with incorrect hash
  command: '{{ package_manager_reinstall_cmd }} ''{{ item }}'''
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - files_with_incorrect_hash.stdout_lines is defined
  - (package_manager_reinstall_cmd is defined and (files_with_incorrect_hash.stdout_lines
    | length &gt; 0))
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000243
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_hashes
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rpm_verify_hashes:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rpm_verify_ownership" severity="high">
                  <xccdf-1.2:title>Verify and Correct Ownership with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description>The RPM package management system can check file ownership permissions of installed software
packages, including many that are important to system security. After locating a file with
incorrect permissions, which can be found with:
<html:pre>rpm -Va | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'</html:pre>
run the following command to determine which package owns it:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i>
          </html:pre>
Next, run the following command to reset its permissions to the correct values:
<html:pre>$ sudo rpm --restore <html:i>PACKAGENAME</html:i>
          </html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:warning category="general">Profiles may require that specific files be owned by root while the default owner defined
by the vendor is different. Such files will be reported as a finding and need to be
evaluated according to your policy and deployment environment.</xccdf-1.2:warning>
                  <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of packages present on the system. It is not a
problem in most cases, but especially systems with a large number of installed packages
can be affected.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001494</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Ownership of binaries and configuration files that is incorrect could allow an unauthorized
user to gain privileges that they should not have. The ownership set by the vendor should be
maintained. Any deviations from this baseline should be investigated.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rpm_verify_ownership" complexity="high" disruption="medium" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

# Declare array to hold set of RPM packages we need to correct permissions for
declare -A SETPERMS_RPM_DICT

# Create a list of files on the system having permissions different from what
# is expected by the RPM database
readarray -t FILES_WITH_INCORRECT_PERMS &lt; &lt;(rpm -Va --nofiledigest | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }')

for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
do
        RPM_PACKAGE=$(rpm -qf "$FILE_PATH")
	# Use an associative array to store packages as it's keys, not having to care about duplicates.
	SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
done

# For each of the RPM packages left in the list -- reset its permissions to the
# correct values
for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
do
        rpm --restore "${RPM_PACKAGE}"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rpm_verify_ownership" complexity="high" disruption="medium" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_ownership

- name: Read list of files with incorrect ownership
  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
    --nocaps --nolinkto --nomode
  register: files_with_incorrect_ownership
  failed_when: files_with_incorrect_ownership.rc &gt; 1
  changed_when: false
  check_mode: false
  when: not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_ownership

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  with_items: '{{ files_with_incorrect_ownership.stdout_lines | map(''regex_findall'',
    ''^[.]+[U|G]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - (files_with_incorrect_ownership.stdout_lines | length &gt; 0)
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_ownership

- name: Correct file ownership with RPM
  command: rpm --restore '{{ item }}'
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - (files_with_incorrect_ownership.stdout_lines | length &gt; 0)
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_ownership
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rpm_verify_ownership:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rpm_verify_ownership_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" severity="high">
                  <xccdf-1.2:title>Verify and Correct File Permissions with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description>The RPM package management system can check file access permissions of installed software
packages, including many that are important to system security. Verify that the file
permissions of system files and commands match vendor values. Check the file permissions with
the following command:
<html:pre>$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'</html:pre>
Output indicates files that do not match vendor defaults.

After locating a file with incorrect permissions, run the following command to determine which
package owns it:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i>
          </html:pre>
          <html:br/>
Next, run the following command to reset its permissions to the correct values:
<html:pre>$ sudo rpm --restore <html:i>PACKAGENAME</html:i>
          </html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:warning category="general">Profiles may require that specific files have stricter file permissions than defined by
the vendor. Such files will be reported as a finding and need to be evaluated according to
your policy and deployment environment.</xccdf-1.2:warning>
                  <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of packages present on the system. It is not a
problem in most cases, but especially systems with a large number of installed packages
can be affected.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001494</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Permissions on system binaries and configuration files that are too generous could allow an
unauthorized user to gain privileges that they should not have. The permissions set by the
vendor should be maintained. Any deviations from this baseline should be investigated.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rpm_verify_permissions" complexity="high" disruption="medium" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

# Declare array to hold set of RPM packages we need to correct permissions for
declare -A SETPERMS_RPM_DICT

# Create a list of files on the system having permissions different from what
# is expected by the RPM database
readarray -t FILES_WITH_INCORRECT_PERMS &lt; &lt;(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')

for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
do
        # NOTE: some files maybe controlled by more then one package
        readarray -t RPM_PACKAGES &lt; &lt;(rpm -qf "${FILE_PATH}")
        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
        do
                # Use an associative array to store packages as it's keys, not having to care about duplicates.
                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
        done
done

# For each of the RPM packages left in the list -- reset its permissions to the
# correct values
for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
do
	rpm --restore "${RPM_PACKAGE}"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rpm_verify_permissions" complexity="high" disruption="medium" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_permissions

- name: Read list of files with incorrect permissions
  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
    --nocaps --nolinkto --nouser --nogroup
  register: files_with_incorrect_permissions
  failed_when: files_with_incorrect_permissions.rc &gt; 1
  changed_when: false
  check_mode: false
  when: not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_permissions

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  with_items: '{{ files_with_incorrect_permissions.stdout_lines | map(''regex_findall'',
    ''^[.]+[M]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_permissions

- name: Correct file permissions with RPM
  command: rpm --restore '{{ item }}'
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when:
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.3.8
  - NIST-800-171-3.4.1
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(c)
  - NIST-800-53-CM-6(d)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - NIST-800-53-SI-7(6)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - high_complexity
  - high_severity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
  - rpm_verify_permissions
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rpm_verify_permissions:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_aide">
                <xccdf-1.2:title>Verify Integrity with AIDE</xccdf-1.2:title>
                <xccdf-1.2:description>AIDE conducts integrity checks by comparing information about
files with previously-gathered information. Ideally, the AIDE database is
created immediately after initial system configuration, and then again after any
software update.  AIDE is highly configurable, with further configuration
information located in <html:code>/usr/share/doc/aide-<html:i>VERSION</html:i>
         </html:code>.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_aide_installed" severity="medium">
                  <xccdf-1.2:title>Install AIDE</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>aide</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install aide</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1034</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1288</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1341</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1417</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R79</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000300</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271496r1091200_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The AIDE package must be installed if it is to be available for integrity checking.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000300
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_aide_installed

- name: Ensure aide is installed
  package:
    name: aide
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000300
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_aide_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_aide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=aide
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_aide_installed">
[[packages]]
name = "aide"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_aide_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_aide_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_build_database" severity="medium">
                  <xccdf-1.2:title>Build and Test AIDE Database</xccdf-1.2:title>
                  <xccdf-1.2:description>Run the following command to generate a new database:

<html:pre>$ sudo /usr/sbin/aide --init</html:pre>

By default, the database will be written to the file

<html:code>/var/lib/aide/aide.db.new.gz</html:code>.

Storing the database, the configuration file <html:code>/etc/aide.conf</html:code>, and the binary
<html:code>/usr/sbin/aide</html:code>
(or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:

<html:pre>$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</html:pre>

To initiate a manual check, run the following command:
<html:pre>$ sudo /usr/sbin/aide --check</html:pre>
If this check produces any unexpected output, investigate.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R79</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_build_database"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi

/usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_build_database" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Ensure AIDE Is Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Build and Test AIDE Database
  ansible.builtin.command: /usr/sbin/aide --init
  changed_when: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Check Whether the Stock AIDE Database Exists
  ansible.builtin.stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Stage AIDE Database
  ansible.builtin.copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_build_database:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_build_database_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" severity="medium">
                  <xccdf-1.2:title>Configure AIDE to Verify the Audit Tools</xccdf-1.2:title>
                  <xccdf-1.2:description>The operating system file integrity tool must be configured to protect the integrity of the audit tools.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001494</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3).1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000710</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271569r1091419_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Protecting the integrity of the tools used for auditing purposes is a
critical step toward ensuring the integrity of audit information. Audit
information includes all information (e.g., audit records, audit settings,
and audit reports) needed to successfully audit information system
activity.

Audit tools include but are not limited to vendor-provided and open-source
audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators.

It is not uncommon for attackers to replace the audit tools or inject code
into the existing tools to provide the capability to hide or erase system
activity from the audit logs.

To address this risk, audit tools must be cryptographically signed to
provide the capability to identify when the audit tools have been modified,
manipulated, or replaced. An example is a checksum hash of the file or
files.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_check_audit_tools" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi










if grep -i '^.*/usr/sbin/auditctl.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/auditd.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/ausearch.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/aureport.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/autrace.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/augenrules.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i '^.*/usr/sbin/rsyslogd.*$' /etc/aide.conf; then
sed -i "s#.*/usr/sbin/rsyslogd.*#/usr/sbin/rsyslogd p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/rsyslogd p+i+n+u+g+s+b+acl+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_check_audit_tools" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000710
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Gather List of Packages
  tags:
  - DISA-STIG-OL09-00-000710
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  ansible.builtin.package_facts:
    manager: auto
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)

- name: Ensure aide is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000710
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set audit_tools fact
  set_fact:
    audit_tools:
    - /usr/sbin/auditctl
    - /usr/sbin/auditd
    - /usr/sbin/augenrules
    - /usr/sbin/aureport
    - /usr/sbin/ausearch
    - /usr/sbin/autrace
    - /usr/sbin/rsyslogd
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000710
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure existing AIDE configuration for audit tools are correct
  lineinfile:
    path: /etc/aide.conf
    regexp: ^{{ item }}\s
    line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
  with_items: '{{ audit_tools }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000710
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to properly protect audit tools
  lineinfile:
    path: /etc/aide.conf
    line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
  with_items: '{{ audit_tools }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000710
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_check_audit_tools:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_check_audit_tools_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" severity="medium">
                  <xccdf-1.2:title>Configure Periodic Execution of AIDE</xccdf-1.2:title>
                  <xccdf-1.2:description>At a minimum, AIDE should be configured to run a weekly scan.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * * root /usr/sbin/aide --check</html:pre>
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * 0 root /usr/sbin/aide --check</html:pre>
AIDE can be executed periodically through other means; this is merely one example.
The usage of cron's special time codes, such as  <html:code>@daily</html:code> and
<html:code>@weekly</html:code> is acceptable.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002702</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000446-GPOS-00200</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000447-GPOS-00201</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000301</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271497r1092471_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
<html:br/>
          <html:br/>
Unauthorized changes to the baseline configuration could make the system vulnerable
to various attacks or allow unauthorized access to the operating system. Changes to
operating system configurations can have unintended side effects, some of which may
be relevant to security.
<html:br/>
          <html:br/>
Detecting such changes and providing an automated response can help avoid unintended,
negative consequences that could ultimately affect the security state of the operating
system. The operating system's Information Management Officer (IMO)/Information System
Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
monitoring system trap when there is an unauthorized modification of a configuration item.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_periodic_cron_checking"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi

if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
else
    sed -i '\!^.* --check.*$!d' /etc/crontab
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_periodic_cron_checking" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set cron package name - RedHat
  set_fact:
    cron_pkg_name: cronie
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_os_family == "RedHat" or ansible_os_family == "Suse"
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set cron package name - Debian
  set_fact:
    cron_pkg_name: cron
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_os_family == "Debian"
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Install cron
  package:
    name: '{{ cron_pkg_name }}'
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Periodic Execution of AIDE
  cron:
    name: run AIDE check
    minute: 5
    hour: 4
    weekday: 0
    user: root
    job: /usr/sbin/aide --check
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.3
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_periodic_cron_checking:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_scan_notification" severity="medium">
                  <xccdf-1.2:title>Configure Notification of Post-AIDE Scan Details</xccdf-1.2:title>
                  <xccdf-1.2:description>AIDE should notify appropriate personnel of the details of a scan after the scan has been run.
If AIDE has already been configured for periodic execution in <html:code>/etc/crontab</html:code>, append the
following line to the existing AIDE line:
<html:pre> | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost</html:pre>
Otherwise, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost</html:pre>
AIDE can be executed periodically through other means; this is merely one example.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002702</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-3(5)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000446-GPOS-00200</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000447-GPOS-00201</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000301</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271497r1092471_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Unauthorized changes to the baseline configuration could make the system vulnerable
to various attacks or allow unauthorized access to the operating system. Changes to
operating system configurations can have unintended side effects, some of which may
be relevant to security.
<html:br/>
          <html:br/>
Detecting such changes and providing an automated response can help avoid unintended,
negative consequences that could ultimately affect the security state of the operating
system. The operating system's Information Management Officer (IMO)/Information System
Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
monitoring system trap when there is an unauthorized modification of a configuration item.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_scan_notification"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi
var_aide_scan_notification_email='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email" use="legacy"/>'



CRONTAB=/etc/crontab
CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'

# NOTE: on some platforms, /etc/crontab may not exist
if [ -f /etc/crontab ]; then
	CRONTAB_EXIST=/etc/crontab
fi

if [ -f /var/spool/cron/root ]; then
	VARSPOOL=/var/spool/cron/root
fi

if ! grep -qR '^.*/usr/sbin/aide\s*\-\-check.*|.*\/bin\/mail\s*-s\s*".*"\s*.*@.*$' $CRONTAB_EXIST $VARSPOOL $CRONDIRS; then
	echo "0 5 * * * root /usr/sbin/aide  --check | /bin/mail -s \"\$(hostname) - AIDE Integrity Check\" $var_aide_scan_notification_email" &gt;&gt; $CRONTAB
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_scan_notification" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_aide_scan_notification_email # promote to variable
  set_fact:
    var_aide_scan_notification_email: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email" use="legacy"/>
  tags:
    - always

- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Notification of Post-AIDE Scan Details
  cron:
    name: run AIDE check
    minute: 5
    hour: 4
    weekday: 0
    user: root
    job: /usr/sbin/aide  --check | /bin/mail -s "$(hostname) - AIDE Integrity Check"
      {{ var_aide_scan_notification_email }}
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000301
  - NIST-800-53-CM-3(5)
  - NIST-800-53-CM-6(a)
  - aide_scan_notification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_scan_notification:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_scan_notification_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" severity="medium">
                  <xccdf-1.2:title>Configure AIDE to Use FIPS 140-2 for Validating Hashes</xccdf-1.2:title>
                  <xccdf-1.2:description>By default, the <html:code>sha512</html:code> option is added to the <html:code>NORMAL</html:code> ruleset in AIDE.
If using a custom ruleset or the <html:code>sha512</html:code> option is missing, add <html:code>sha512</html:code>
to the appropriate ruleset.
For example, add <html:code>sha512</html:code> to the following line in <html:code>/etc/aide.conf</html:code>:
<html:pre>NORMAL = FIPSR+sha512</html:pre>
AIDE rules can be configured in multiple ways; this is merely one example that is already
configured by default.</xccdf-1.2:description>
                  <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000302</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271498r1091206_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>File integrity tools use cryptographic hashes for verifying file contents and directories
have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_use_fips_hashes"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi

aide_conf="/etc/aide.conf"
forbidden_hashes=(sha1 rmd160 sha256 whirlpool tiger haval gost crc32)

groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | cut -f1 -d ' ' | tr -d ' ' | sort -u)

for group in $groups
do
	config=$(grep "^$group\s*=" $aide_conf | cut -f2 -d '=' | tr -d ' ')

	if ! [[ $config = *sha512* ]]
	then
		config=$config"+sha512"
	fi

	for hash in "${forbidden_hashes[@]}"
	do
		config=$(echo $config | sed "s/$hash//")
	done

	config=$(echo $config | sed "s/^\+*//")
	config=$(echo $config | sed "s/\+\++/+/")
	config=$(echo $config | sed "s/\+$//")

	sed -i "s/^$group\s*=.*/$group = $config/g" $aide_conf
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_use_fips_hashes" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000302
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_use_fips_hashes
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure AIDE to Use FIPS 140-2 for Validating Hashes - Ensure aide is installed
  ansible.builtin.package:
    name: aide
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000302
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_use_fips_hashes
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure AIDE to Use FIPS 140-2 for Validating Hashes - Set-fact aide config
    file and forbidden hashes
  ansible.builtin.set_fact:
    aide_conf: /etc/aide.conf
    forbidden_hashes:
    - sha1
    - rmd160
    - sha256
    - whirlpool
    - tiger
    - haval
    - gost
    - crc32
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000302
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_use_fips_hashes
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure AIDE to Use FIPS 140-2 for Validating Hashes - Remove forbidden
    hashes
  ansible.builtin.replace:
    path: '{{ aide_conf }}'
    regexp: (^\s*[A-Z][A-Za-z_]*\s*=.*?)({{ item }}\+|\+?{{ item }})(.*)
    replace: \1\3
  loop: '{{ forbidden_hashes }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000302
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_use_fips_hashes
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure AIDE to Use FIPS 140-2 for Validating Hashes - Set sha512
  ansible.builtin.replace:
    path: '{{ aide_conf }}'
    regexp: (^\s*[A-Z][A-Za-z_]*\s*=)((?:(?!\+?sha512).)*)\s*$
    replace: \1\2+sha512
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000302
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_use_fips_hashes
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_use_fips_hashes:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_use_fips_hashes_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_verify_acls" severity="low">
                  <xccdf-1.2:title>Configure AIDE to Verify Access Control Lists (ACLs)</xccdf-1.2:title>
                  <xccdf-1.2:description>By default, the <html:code>acl</html:code> option is added to the <html:code>FIPSR</html:code> ruleset in AIDE.
If using a custom ruleset or the <html:code>acl</html:code> option is missing, add <html:code>acl</html:code>
to the appropriate ruleset.
For example, add <html:code>acl</html:code> to the following line in <html:code>/etc/aide.conf</html:code>:
<html:pre>FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256</html:pre>
AIDE rules can be configured in multiple ways; this is merely one example that is already
configured by default.


The remediation provided with this rule adds <html:code>acl</html:code> to all rule sets available in
<html:code>/etc/aide.conf</html:code>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000303</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271499r1091209_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>ACLs can provide permissions beyond those permitted through the file mode and must be
verified by the file integrity tools.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_verify_acls"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi

aide_conf="/etc/aide.conf"


groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u)


for group in $groups
do
	config=$(grep "^$group\s*=" $aide_conf | cut -f2 -d '=' | tr -d ' ')

	if ! [[ $config = *acl* ]]
	then
		if [[ -z $config ]]
		then
			config="acl"
		else
			config=$config"+acl"
		fi
	fi
	sed -i "s/^$group\s*=.*/$group = $config/g" $aide_conf
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_verify_acls" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather list of packages
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000303
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_acls
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get rules groups
  shell: |
    set -o pipefail
    LC_ALL=C grep "^[A-Z][A-Za-z_]*" /etc/aide.conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u || true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '''aide'' in ansible_facts.packages'
  register: find_rules_groups_results
  tags:
  - DISA-STIG-OL09-00-000303
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_acls
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the acl rule is present when aide is installed.
  replace:
    path: /etc/aide.conf
    regexp: (^\s*{{ item }}\s*=\s*)(?!.*acl)([^\s]*)
    replace: \g&lt;1&gt;\g&lt;2&gt;+acl
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"
  with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list }}'
  tags:
  - DISA-STIG-OL09-00-000303
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_acls
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_verify_acls:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_verify_acls_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" severity="low">
                  <xccdf-1.2:title>Configure AIDE to Verify Extended Attributes</xccdf-1.2:title>
                  <xccdf-1.2:description>By default, the <html:code>xattrs</html:code> option is added to the <html:code>FIPSR</html:code> ruleset in AIDE.
If using a custom ruleset or the <html:code>xattrs</html:code> option is missing, add <html:code>xattrs</html:code>
to the appropriate ruleset.
For example, add <html:code>xattrs</html:code> to the following line in <html:code>/etc/aide.conf</html:code>:
<html:pre>FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256</html:pre>
AIDE rules can be configured in multiple ways; this is merely one example that is already
configured by default.


The remediation provided with this rule adds <html:code>xattrs</html:code> to all rule sets available in
<html:code>/etc/aide.conf</html:code>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000304</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271500r1091212_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Extended attributes in file systems are used to contain arbitrary data and file metadata
with security implications.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="aide_verify_ext_attributes"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "aide" ; then
    yum install -y "aide"
fi

aide_conf="/etc/aide.conf"


groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u)


for group in $groups
do
	config=$(grep "^$group\s*=" $aide_conf | cut -f2 -d '=' | tr -d ' ')

	if ! [[ $config = *xattrs* ]]
	then
		if [[ -z $config ]]
		then
			config="xattrs"
		else
			config=$config"+xattrs"
		fi
	fi
	sed -i "s/^$group\s*=.*/$group = $config/g" $aide_conf
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="aide_verify_ext_attributes" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather list of packages
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000304
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get rules groups
  shell: |
    set -o pipefail
    LC_ALL=C grep "^[A-Z][A-Za-z_]*" /etc/aide.conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u || true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '''aide'' in ansible_facts.packages'
  register: find_rules_groups_results
  tags:
  - DISA-STIG-OL09-00-000304
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the xattrs rule is present when aide is installed.
  replace:
    path: /etc/aide.conf
    regexp: (^\s*{{ item }}\s*=\s*)(?!.*xattrs)([^\s]*)
    replace: \g&lt;1&gt;\g&lt;2&gt;+xattrs
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"
  with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list }}'
  tags:
  - DISA-STIG-OL09-00-000304
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - aide_verify_ext_attributes
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-aide_verify_ext_attributes:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-aide_verify_ext_attributes_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership" severity="medium">
                  <xccdf-1.2:title>Audit Tools Must Be Group-owned by Root</xccdf-1.2:title>
                  <xccdf-1.2:description>Oracle Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools.

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Audit tools must have the correct group owner.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002570</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271824r1092184_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data.
Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_audit_tools_group_ownership" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp 0 /sbin/auditctl
chgrp 0 /sbin/aureport
chgrp 0 /sbin/ausearch
chgrp 0 /sbin/autrace
chgrp 0 /sbin/auditd
chgrp 0 /sbin/rsyslogd
chgrp 0 /sbin/augenrules

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_audit_tools_group_ownership" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditctl
  stat:
    path: /sbin/auditctl
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/auditctl
  file:
    path: /sbin/auditctl
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/aureport
  stat:
    path: /sbin/aureport
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/aureport
  file:
    path: /sbin/aureport
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/ausearch
  stat:
    path: /sbin/ausearch
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/ausearch
  file:
    path: /sbin/ausearch
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/autrace
  stat:
    path: /sbin/autrace
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/autrace
  file:
    path: /sbin/autrace
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditd
  stat:
    path: /sbin/auditd
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/auditd
  file:
    path: /sbin/auditd
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/rsyslogd
  stat:
    path: /sbin/rsyslogd
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/rsyslogd
  file:
    path: /sbin/rsyslogd
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/augenrules
  stat:
    path: /sbin/augenrules
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /sbin/augenrules
  file:
    path: /sbin/augenrules
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002570
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_audit_tools_group_ownership:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_audit_tools_group_ownership_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_audit_tools_ownership" severity="medium">
                  <xccdf-1.2:title>Audit Tools Must Be Owned by Root</xccdf-1.2:title>
                  <xccdf-1.2:description>Oracle Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools.

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Audit tools must have the correct owner.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002571</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271825r1092187_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data.
Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_audit_tools_ownership" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /sbin/auditctl
chown 0 /sbin/aureport
chown 0 /sbin/ausearch
chown 0 /sbin/autrace
chown 0 /sbin/auditd
chown 0 /sbin/rsyslogd
chown 0 /sbin/augenrules

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_audit_tools_ownership" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditctl
  stat:
    path: /sbin/auditctl
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/auditctl
  file:
    path: /sbin/auditctl
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/aureport
  stat:
    path: /sbin/aureport
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/aureport
  file:
    path: /sbin/aureport
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/ausearch
  stat:
    path: /sbin/ausearch
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/ausearch
  file:
    path: /sbin/ausearch
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/autrace
  stat:
    path: /sbin/autrace
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/autrace
  file:
    path: /sbin/autrace
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditd
  stat:
    path: /sbin/auditd
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/auditd
  file:
    path: /sbin/auditd
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/rsyslogd
  stat:
    path: /sbin/rsyslogd
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/rsyslogd
  file:
    path: /sbin/rsyslogd
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/augenrules
  stat:
    path: /sbin/augenrules
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /sbin/augenrules
  file:
    path: /sbin/augenrules
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002571
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_audit_tools_ownership:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_audit_tools_ownership_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_audit_tools_permissions" severity="medium">
                  <xccdf-1.2:title>Audit Tools Must Have a Mode of 0755 or Less Permissive</xccdf-1.2:title>
                  <xccdf-1.2:description>Oracle Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools.

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Audit tools must have a mode of 0755 or less permissive.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002572</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271826r1092190_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data.
Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_audit_tools_permissions" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-s,g-ws,o-wt /sbin/auditctl

chmod u-s,g-ws,o-wt /sbin/aureport

chmod u-s,g-ws,o-wt /sbin/ausearch

chmod u-s,g-ws,o-wt /sbin/autrace

chmod u-s,g-ws,o-wt /sbin/auditd

chmod u-s,g-ws,o-wt /sbin/rsyslogd

chmod u-s,g-ws,o-wt /sbin/augenrules

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_audit_tools_permissions" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditctl
  stat:
    path: /sbin/auditctl
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/auditctl
  file:
    path: /sbin/auditctl
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/aureport
  stat:
    path: /sbin/aureport
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/aureport
  file:
    path: /sbin/aureport
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/ausearch
  stat:
    path: /sbin/ausearch
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/ausearch
  file:
    path: /sbin/ausearch
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/autrace
  stat:
    path: /sbin/autrace
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/autrace
  file:
    path: /sbin/autrace
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditd
  stat:
    path: /sbin/auditd
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/auditd
  file:
    path: /sbin/auditd
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/rsyslogd
  stat:
    path: /sbin/rsyslogd
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/rsyslogd
  file:
    path: /sbin/rsyslogd
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/augenrules
  stat:
    path: /sbin/augenrules
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/augenrules
  file:
    path: /sbin/augenrules
    mode: u-s,g-ws,o-wt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002572
  - NIST-800-53-AU-9
  - configure_strategy
  - file_audit_tools_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_audit_tools_permissions:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_audit_tools_permissions_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_fips">
              <xccdf-1.2:title>Federal Information Processing Standard (FIPS)</xccdf-1.2:title>
              <xccdf-1.2:description>The Federal Information Processing Standard (FIPS) is a computer security standard which
is developed by the U.S. Government and industry working groups to validate the quality
of cryptographic modules. The FIPS standard provides four security levels to ensure
adequate coverage of different industries, implementation of cryptographic modules, and
organizational sizes and requirements.
<html:br/>
        <html:br/>
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
utilize authentication that meets industry and government requirements. For government systems, this allows
Security Levels 1, 2, 3, or 4 for use on Oracle Linux 9.
<html:br/>
        <html:br/>
See <html:b><html:a href="http://csrc.nist.gov/publications/PubsFIPS.html">http://csrc.nist.gov/publications/PubsFIPS.html</html:a></html:b> for more information.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#not_osbuild_and_system_with_kernel"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" severity="high">
                <xccdf-1.2:title>Enable Dracut FIPS Module</xccdf-1.2:title>
                <xccdf-1.2:description>
To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre>

To enable FIPS, the system requires that the <html:code>fips</html:code> module is added in <html:code>dracut</html:code> configuration.
Check if <html:code>/etc/dracut.conf.d/40-fips.conf</html:code> contain <html:code>add_dracutmodules+=" fips "</html:code>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">
The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use cryptographic-based security
systems to protect sensitive information in computer and telecommunication systems
(including voice systems) as defined in Section 5131 of the Information Technology
Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing
and implementing cryptographic modules that Federal departments and agencies operate or are
operated for them under contract.
See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by a vendor that has
undergone this certification. This means providing documentation, test results, design
information, and independent third party review by an accredited lab. While open source
software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to
this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_RBG_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000070</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271454r1092458_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#not_bootc"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="enable_dracut_fips_module"># Remediation is applicable only in certain platforms
if ( ! ( [ "${container:-}" == "bwrap-osbuild" ] ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

fips-mode-setup --enable
FIPS_CONF="/etc/dracut.conf.d/40-fips.conf"
if ! grep "^add_dracutmodules+=\" fips \"" $FIPS_CONF; then
    echo "add_dracutmodules+=\" fips \"" &gt;&gt; $FIPS_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="enable_dracut_fips_module" complexity="medium" disruption="medium" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000070
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_dracut_fips_module
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Check to see the current status of FIPS mode
  command: /usr/bin/fips-mode-setup --check
  register: is_fips_enabled
  changed_when: false
  failed_when: false
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - DISA-STIG-OL09-00-000070
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_dracut_fips_module
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Enable FIPS mode
  command: /usr/bin/fips-mode-setup --enable
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - is_fips_enabled.stdout.find('FIPS mode is enabled.') == -1
  tags:
  - DISA-STIG-OL09-00-000070
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_dracut_fips_module
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy

- name: Enable Dracut FIPS Module
  lineinfile:
    path: /etc/dracut.conf.d/40-fips.conf
    line: add_dracutmodules+=" fips "
  when:
  - ( not ( lookup("env", "container") == "bwrap-osbuild" ) and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - DISA-STIG-OL09-00-000070
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-7
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - enable_dracut_fips_module
  - high_severity
  - medium_complexity
  - medium_disruption
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-enable_dracut_fips_module:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-enable_dracut_fips_module_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_fips_mode" severity="high">
                <xccdf-1.2:title>Enable FIPS Mode</xccdf-1.2:title>
                <xccdf-1.2:description>
To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre>
         <html:br/>
The <html:code>fips-mode-setup</html:code> command will configure the system in
FIPS mode by automatically configuring the following:
<html:ul><html:li>Setting the kernel FIPS mode flag (<html:code>/proc/sys/crypto/fips_enabled</html:code>) to <html:code>1</html:code>
          </html:li><html:li>Creating <html:code>/etc/system-fips</html:code>
          </html:li><html:li>Setting the system crypto policy in <html:code>/etc/crypto-policies/config</html:code> to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code>
          </html:li><html:li>Loading the Dracut <html:code>fips</html:code> module</html:li></html:ul>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">To configure Oracle Linux 9 to run in FIPS 140 mode, the kernel parameter "fips=1" needs to be added during its installation.
Only enabling FIPS 140 mode during the Oracle Linux 9 installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place.
Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
You can find the list of FIPS certified modules at 
<html:a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search">https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search</html:a>.
This rule checks if the system is running in FIPS mode.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-3(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_RBG_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000070</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271454r1092458_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="enable_fips_mode"># Remediation is applicable only in certain platforms
if ( ! ( [ "${container:-}" == "bwrap-osbuild" ] ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
	cat &gt; /usr/lib/bootc/kargs.d/01-fips.toml &lt;&lt; EOF
kargs = ["fips=1"]
EOF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="enable_fips_mode">
[customizations]
fips = true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-enable_fips_mode:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-enable_fips_mode_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_etc_system_fips_exists" severity="high">
                <xccdf-1.2:title>Ensure '/etc/system-fips' exists</xccdf-1.2:title>
                <xccdf-1.2:description>On a system where FIPS mode is enabled, <html:code>/etc/system-fips</html:code> must exist.

To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">
The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-etc_system_fips_exists:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-etc_system_fips_exists_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" severity="high">
                <xccdf-1.2:title>Set kernel parameter 'crypto.fips_enabled' to 1</xccdf-1.2:title>
                <xccdf-1.2:description>System running in FIPS mode is indicated by kernel parameter
<html:code>'crypto.fips_enabled'</html:code>. This parameter should be set to <html:code>1</html:code> in FIPS mode.

To enable FIPS mode, run the following command:
<html:pre>fips-mode-setup --enable</html:pre>



To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel boot
parameters during system installation so key generation is done with FIPS-approved algorithms
and continuous monitoring tests in place.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use cryptographic-based security
systems to protect sensitive information in computer and telecommunication systems
(including voice systems) as defined in Section 5131 of the Information Technology
Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing
and implementing cryptographic modules that Federal departments and agencies operate or are
operated for them under contract.
See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by a vendor that has
undergone this certification. This means providing documentation, test results, design
information, and independent third party review by an accredited lab. While open source
software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to
this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000478-GPOS-00223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000070</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271454r1092458_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
protect data. The operating system must implement cryptographic modules adhering to the higher
standards approved by the federal government since this provides assurance they have been tested
and validated.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_crypto_fips_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_crypto_fips_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_crypto">
              <xccdf-1.2:title>System Cryptographic Policies</xccdf-1.2:title>
              <xccdf-1.2:description>Linux has the capability to centrally configure cryptographic polices. The command
<html:code>update-crypto-policies</html:code> is used to set the policy applicable for the various
cryptographic back-ends, such as SSL/TLS libraries. The configured cryptographic
policies will be the default policy used by these backends unless the application
user configures them otherwise. When the system has been configured to use the
centralized cryptographic policies, the administrator is assured that any application
that utilizes the supported backends will follow a policy that adheres to the
configured profile.

Currently the supported backends are:
<html:ul><html:li>GnuTLS library</html:li><html:li>OpenSSL library</html:li><html:li>NSS library</html:li><html:li>OpenJDK</html:li><html:li>Libkrb5</html:li><html:li>BIND</html:li><html:li>OpenSSH</html:li></html:ul>
Applications and languages which rely on any of these backends will follow the
system policies as well. Examples are apache httpd, nginx, php, and others.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" type="string" interactive="true">
                <xccdf-1.2:title>SSH client RekeyLimit - size</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the size component of the rekey limit. This limit signifies amount
of data. After this amount of data is transferred through the connection,
the session key is renegotiated. The number is followed by K, M or G for
kilobytes, megabytes or gigabytes. Note that the RekeyLimit can be also
configured according to elapsed time.</xccdf-1.2:description>
                <xccdf-1.2:value>512M</xccdf-1.2:value>
                <xccdf-1.2:value selector="512M">512M</xccdf-1.2:value>
                <xccdf-1.2:value selector="1G">1G</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" type="string" interactive="true">
                <xccdf-1.2:title>SSH client RekeyLimit - time</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the time component of the rekey limit. The session key is
renegotiated after the defined amount of time passes. The number is followed
by units such as H or M for hours or minutes. Note that the RekeyLimit can
be also configured according to amount of transfered data.</xccdf-1.2:description>
                <xccdf-1.2:value>1h</xccdf-1.2:value>
                <xccdf-1.2:value selector="1hour">1h</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_system_crypto_policy" type="string">
                <xccdf-1.2:title>The system-provided crypto policies</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the crypto policy for the system.</xccdf-1.2:description>
                <xccdf-1.2:value>DEFAULT</xccdf-1.2:value>
                <xccdf-1.2:value selector="default_policy">DEFAULT</xccdf-1.2:value>
                <xccdf-1.2:value selector="default_nosha1">DEFAULT:NO-SHA1</xccdf-1.2:value>
                <xccdf-1.2:value selector="fips">FIPS</xccdf-1.2:value>
                <xccdf-1.2:value selector="fips_ospp">FIPS:OSPP</xccdf-1.2:value>
                <xccdf-1.2:value selector="legacy">LEGACY</xccdf-1.2:value>
                <xccdf-1.2:value selector="future">FUTURE</xccdf-1.2:value>
                <xccdf-1.2:value selector="next">NEXT</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_crypto-policies_installed" severity="medium">
                <xccdf-1.2:title>Install crypto-policies package</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>crypto-policies</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install crypto-policies</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002890</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003123</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000240</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271477r1091143_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_crypto-policies_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "crypto-policies" ; then
    yum install -y "crypto-policies"
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_crypto-policies_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure crypto-policies is installed
  package:
    name: crypto-policies
    state: present
  tags:
  - DISA-STIG-OL09-00-000240
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_crypto-policies_installed
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_crypto-policies_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_crypto-policies

class install_crypto-policies {
  package { 'crypto-policies':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_crypto-policies_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=crypto-policies
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_crypto-policies_installed">
[[packages]]
name = "crypto-policies"
version = "*"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_crypto-policies_installed:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_crypto-policies_installed_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure BIND to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
BIND is supported by crypto policy, but the BIND configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code>/etc/named.conf</html:code>
includes the appropriate configuration:
In the <html:code>options</html:code> section of <html:code>/etc/named.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code>include "/etc/crypto-policies/back-ends/bind.config";</html:code>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271759r1091989_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the BIND service violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_bind"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_bind_crypto_policy"># Remediation is applicable only in certain platforms
if rpm --quiet -q bind; then

function remediate_bind_crypto_policy() {
	CONFIG_FILE="/etc/named.conf"
	if test -f "$CONFIG_FILE"; then
		sed -i 's|options {|&amp;\n\tinclude "/etc/crypto-policies/back-ends/bind.config";|' "$CONFIG_FILE"
		return 0
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_bind_crypto_policy

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_bind_crypto_policy" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002421
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - configure_bind_crypto_policy
  - configure_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed

- name: Configure BIND to use System Crypto Policy - Check BIND configuration file
    exists
  ansible.builtin.stat:
    path: /etc/named.conf
  register: bind_config_file
  when: '"bind" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002421
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - configure_bind_crypto_policy
  - configure_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed

- name: Configure BIND to use System Crypto Policy - Aborting remediation, file not
    found
  ansible.builtin.debug:
    msg: Aborting remediation as '/etc/named.conf' was not found.
  when:
  - '"bind" in ansible_facts.packages'
  - not bind_config_file.stat.exists
  tags:
  - DISA-STIG-OL09-00-002421
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - configure_bind_crypto_policy
  - configure_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed

- name: Configure BIND to use System Crypto Policy - Insert crypto-policy into BIND
    config
  ansible.builtin.lineinfile:
    path: /etc/named.conf
    insertafter: ^\s*options\s*{
    line: ' include "/etc/crypto-policies/back-ends/bind.config";'
    state: present
  when:
  - '"bind" in ansible_facts.packages'
  - bind_config_file.stat.exists
  tags:
  - DISA-STIG-OL09-00-002421
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - configure_bind_crypto_policy
  - configure_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_bind_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure System Cryptography Policy</xccdf-1.2:title>
                <xccdf-1.2:description>To configure the system cryptography policy to use ciphers only from the <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code>
policy, run the following command:
<html:pre>$ sudo update-crypto-policies --set <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
         </html:pre>
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the <html:code>/etc/crypto-policies/back-ends</html:code> are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003123</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002450</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002890</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000070</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000241</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271454r1092458_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271478r1092620_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_crypto_policy">
var_system_crypto_policy='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>'


stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2&gt;&amp;1 &gt; /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" &gt;&amp;2
	echo "Make sure that the script is installed on the remediated system." &gt;&amp;2
	echo "See output of the 'dnf provides update-crypto-policies' command" &gt;&amp;2
	echo "to see what package to (re)install" &gt;&amp;2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" &gt;&amp;2
	false  # end with an error code
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_crypto_policy" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
  tags:
    - always

- name: Configure System Cryptography Policy
  lineinfile:
    path: /etc/crypto-policies/config
    regexp: ^(?!#)(\S+)$
    line: '{{ var_system_crypto_policy }}'
    create: true
  tags:
  - DISA-STIG-OL09-00-000070
  - DISA-STIG-OL09-00-000241
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Verify that Crypto Policy is Set (runtime)
  command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}
  tags:
  - DISA-STIG-OL09-00-000070
  - DISA-STIG-OL09-00-000241
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure Kerberos to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Kerberos is supported by crypto policy, but it's configuration may be
set up to ignore it.
To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at
/etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config.
If the symlink exists, Kerberos is configured to use the system-wide crypto policy settings.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002424</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271762r1091998_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of Kerberos violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_kerberos_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="configure">
rm -f /etc/krb5.conf.d/crypto-policies
ln -s /etc/crypto-policies/back-ends/krb5.config /etc/krb5.conf.d/crypto-policies
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_kerberos_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="configure">- name: Configure Kerberos to use System Crypto Policy
  file:
    src: /etc/crypto-policies/back-ends/krb5.config
    path: /etc/krb5.conf.d/crypto-policies
    state: link
  tags:
  - DISA-STIG-OL09-00-002424
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - configure_kerberos_crypto_policy
  - configure_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_kerberos_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure Libreswan to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Libreswan is supported by system crypto policy, but the Libreswan configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code>/etc/ipsec.conf</html:code>
includes the appropriate configuration file.
In <html:code>/etc/ipsec.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code>include /etc/crypto-policies/back-ends/libreswan.config</html:code>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002404</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271743r1092635_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the Libreswan
service violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_libreswan_crypto_policy">
function remediate_libreswan_crypto_policy() {
    CONFIG_FILE="/etc/ipsec.conf"
    if ! grep -qP "^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$" "$CONFIG_FILE" ; then
        # the file might not end with a new line
        echo -e '\ninclude /etc/crypto-policies/back-ends/libreswan.config' &gt;&gt; "$CONFIG_FILE"
    fi
    return 0
}

remediate_libreswan_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_libreswan_crypto_policy" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Configure Libreswan to use System Crypto Policy
  lineinfile:
    path: /etc/ipsec.conf
    line: include /etc/crypto-policies/back-ends/libreswan.config
    create: true
  tags:
  - DISA-STIG-OL09-00-002404
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - configure_libreswan_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_libreswan_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure OpenSSL library to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSL is supported by crypto policy, but the OpenSSL configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
available under <html:code>/etc/pki/tls/openssl.cnf</html:code>.
This file has the <html:code>ini</html:code> format, and it enables crypto policy support
if there is a <html:code>[ crypto_policy ]</html:code> section that contains the <html:code>.include = /etc/crypto-policies/back-ends/opensslcnf.config</html:code> directive.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1/ENCRYPT</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1/HASH</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1/SIGN</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1/KEYHMAC</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the Java runtime violates expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_openssl_crypto_policy">
OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'

OPENSSL_CRYPTO_POLICY_INCLUSION='.include = /etc/crypto-policies/back-ends/opensslcnf.config'

OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'



  


function remediate_openssl_crypto_policy() {
	CONFIG_FILE=/etc/pki/tls/openssl.cnf
	if test -f "$CONFIG_FILE"; then
		if ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_SECTION_REGEX" "$CONFIG_FILE"; then
			printf '\n%s\n\n%s' "$OPENSSL_CRYPTO_POLICY_SECTION" "$OPENSSL_CRYPTO_POLICY_INCLUSION" &gt;&gt; "$CONFIG_FILE"
			return 0
		elif ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX" "$CONFIG_FILE"; then
			sed -i "s|$OPENSSL_CRYPTO_POLICY_SECTION_REGEX|&amp;\\n\\n$OPENSSL_CRYPTO_POLICY_INCLUSION\\n|" "$CONFIG_FILE"
			return 0
		fi
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_openssl_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_openssl_crypto_policy" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Configure OpenSSL library to use System Crypto Policy - Search for crypto_policy
    Section
  ansible.builtin.find:
    paths: /etc/pki/tls
    patterns: openssl.cnf
    contains: ^\s*\[\s*crypto_policy\s*]
  register: test_crypto_policy_group
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - configure_openssl_crypto_policy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Configure OpenSSL library to use System Crypto Policy - Search for crypto_policy
    Section Together With .include Directive
  ansible.builtin.find:
    paths: /etc/pki/tls
    patterns: openssl.cnf
    contains: ^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$
  register: test_crypto_policy_include_directive
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - configure_openssl_crypto_policy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Configure OpenSSL library to use System Crypto Policy - Add .include Line
    for opensslcnf.config File in crypto_policy Section
  ansible.builtin.lineinfile:
    create: true
    insertafter: ^\s*\[\s*crypto_policy\s*]\s*
    line: .include = /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
  - test_crypto_policy_group.matched &gt; 0
  - test_crypto_policy_include_directive.matched == 0
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - configure_openssl_crypto_policy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Configure OpenSSL library to use System Crypto Policy - Add crypto_policy
    Section With .include for opensslcnf.config File
  ansible.builtin.lineinfile:
    create: true
    line: |-
      [crypto_policy]
      .include = /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when: test_crypto_policy_group.matched == 0
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - configure_openssl_crypto_policy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_openssl_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure SSH to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the <html:code>CRYPTO_POLICY</html:code> variable is either commented or not set at all
in the <html:code>/etc/sysconfig/sshd</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_ssh_crypto_policy">
SSH_CONF="/etc/sysconfig/sshd"

sed -i "/^\s*CRYPTO_POLICY.*$/Id" $SSH_CONF
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_ssh_crypto_policy" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Configure SSH to use System Crypto Policy
  lineinfile:
    dest: /etc/sysconfig/sshd
    state: absent
    regexp: (?i)^\s*CRYPTO_POLICY.*$
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_ssh_crypto_policy
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_ssh_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_ssh_client_crypto_policy" severity="medium">
                <xccdf-1.2:title>Harden SSH client Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies are means of enforcing certain cryptographic settings for selected applications including OpenSSH client.
To override the system wide crypto policy for Openssh client, place a file in the <html:code>/etc/ssh/ssh_config.d/</html:code> so that it is loaded before the <html:code>05-redhat.conf</html:code>. In this case it is file named <html:code>02-ospp.conf</html:code> containing parameters which need to be changed with respect to the crypto policy.
This rule checks if the file exists and if it contains required parameters and values which modify the Crypto Policy.
During the parsing process, as soon as Openssh client parses some configuration option and its value, it remembers it and ignores any subsequent overrides. The customization mechanism provided by crypto policies appends eventual customizations at the end of the system wide crypto policy. Therefore, if the crypto policy customization overrides some parameter which is already configured in the system wide crypto policy, the SSH client will not honor that customized parameter.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The Common Criteria requirements specify how certain parameters for OpenSSH Client are configured. Particular parameters are RekeyLimit, GSSAPIAuthentication, Ciphers, PubkeyAcceptedKeyTypes, MACs and KexAlgorithms. Currently particular requirements specified by CC are stricter compared to any existing Crypto Policy.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="harden_ssh_client_crypto_policy">
#the file starts with 02 so that it is loaded before the 05-redhat.conf which activates configuration provided by system vide crypto policy
file="/etc/ssh/ssh_config.d/02-ospp.conf"
echo -e "Match final all\n\
RekeyLimit 512M 1h\n\
GSSAPIAuthentication no\n\
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc\n\
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256\n\
MACs hmac-sha2-512,hmac-sha2-256\n\
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1\n" &gt; "$file"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-harden_ssh_client_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy" severity="high">
                <xccdf-1.2:title>Configure SSH Client to Use FIPS 140 Validated Ciphers: openssh.config</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
set up incorrectly.

To check that Crypto Policies settings for ciphers are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/openssh.config</html:code> contains the following
line and is not commented out:
<html:pre>Ciphers <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract.
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000261</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271489r1092627_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the OpenSSH client
violate expectations, and makes system configuration more fragmented. By
specifying a cipher list with the order of ciphers being in a “strongest to
weakest” orientation, the system will automatically attempt to use the
strongest cipher for securing SSH connections.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="harden_sshd_ciphers_openssh_conf_crypto_policy" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: XCCDF Value sshd_approved_ciphers # promote to variable
  set_fact:
    sshd_approved_ciphers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" use="legacy"/>
  tags:
    - always

- name: 'Configure SSH Daemon to Use FIPS 140-2 Validated Ciphers: openssh.config'
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/crypto-policies/back-ends/openssh.config
      create: true
      regexp: (?i)^.*Ciphers\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/crypto-policies/back-ends/openssh.config
    lineinfile:
      path: /etc/crypto-policies/back-ends/openssh.config
      create: true
      regexp: (?i)^.*Ciphers\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/crypto-policies/back-ends/openssh.config
    lineinfile:
      path: /etc/crypto-policies/back-ends/openssh.config
      create: true
      regexp: (?i)^.*Ciphers\s+
      line: Ciphers {{ sshd_approved_ciphers }}
      state: present
  tags:
  - DISA-STIG-OL09-00-000261
  - NIST-800-53-AC-17(2)
  - harden_sshd_ciphers_openssh_conf_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_approved_ciphers:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
set up incorrectly.

To check that Crypto Policies settings for ciphers are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/opensshserver.config</html:code> contains the following
text and is not commented out:
<html:pre>-oCiphers=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000254</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271485r1092625_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the OpenSSH server
violate expectations, and makes system configuration more fragmented. By
specifying a cipher list with the order of ciphers being in a “strongest to
weakest” orientation, the system will automatically attempt to use the
strongest cipher for securing SSH connections.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_approved_ciphers:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
set up incorrectly.

To check that Crypto Policies settings are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/openssh.config</html:code> contains the following
line and is not commented out:
<html:code>MACs <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_macs" use="legacy"/>
         </html:code>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the OpenSSH
client violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_approved_macs:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_approved_macs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy" severity="medium">
                <xccdf-1.2:title>Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config</xccdf-1.2:title>
                <xccdf-1.2:description>Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSH is supported by system crypto policy, but the OpenSSH configuration may be
set up incorrectly.

To check that Crypto Policies settings are configured correctly, ensure that
<html:code>/etc/crypto-policies/back-ends/opensshserver.config</html:code> contains the following
text and is not commented out:
<html:code>-oMACS=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_approved_macs" use="legacy"/>
         </html:code>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Overriding the system crypto policy makes the behavior of the OpenSSH
server violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sshd_approved_macs:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_approved_macs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_certified-vendor">
              <xccdf-1.2:title>Operating System Vendor Support and Certification</xccdf-1.2:title>
              <xccdf-1.2:description>The assurance of a vendor to provide operating system support and maintenance
for their product is an important criterion to ensure product stability and
security over the life of the product. A certified product that follows the
necessary standards and government certification requirements guarantees that
known software vulnerabilities will be remediated, and proper guidance for
protecting and securing the operating system will be given.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" severity="high">
                <xccdf-1.2:title>The Installed Operating System Is Vendor Supported</xccdf-1.2:title>
                <xccdf-1.2:description>The installed operating system must be maintained by a vendor.

Oracle Linux is supported by Oracle Corporation. As the Oracle
Linux vendor, Oracle Corporation is responsible for providing security patches.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">There is no remediation besides switching to a different operating system.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-13(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271438r1091026_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An operating system is considered "supported" if the vendor continues to
provide security patches for the product.  With an unsupported release, it
will not be possible to resolve any security issue discovered in the system
software.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-installed_OS_is_vendor_supported:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_endpoint_security_software">
              <xccdf-1.2:title>Endpoint Protection Software</xccdf-1.2:title>
              <xccdf-1.2:description>Endpoint protection security software that is not provided or supported

by Oracle Corporation can be installed to provide complementary or duplicative

security capabilities to those provided by the base platform.  Add-on
software may not be appropriate for some specialized systems.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_user_data_backups" severity="medium">
                <xccdf-1.2:title>Configure Backups of User Data</xccdf-1.2:title>
                <xccdf-1.2:description>The operating system must conduct backups of user data contained
in the operating system. The operating system provides utilities for
automating backups of user data. Commercial and open-source products
are also available.</xccdf-1.2:description>
                <xccdf-1.2:rationale>Operating system backup is a critical step in maintaining data assurance and
availability. User-level information is data generated by information system
and/or application users. Backups shall be consistent with organizational
recovery time and recovery point objectives.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_security_software">
                <xccdf-1.2:title>McAfee Endpoint Security Software</xccdf-1.2:title>
                <xccdf-1.2:description>In DoD environments, McAfee Host-based Security System (HBSS) and
VirusScan Enterprise for Linux (VSEL) is required to be installed on all systems.</xccdf-1.2:description>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software">
                  <xccdf-1.2:title>McAfee Endpoint Security for Linux (ENSL)</xccdf-1.2:title>
                  <xccdf-1.2:description>McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="#system_with_kernel"/>
                  <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_mcafeetp_installed" severity="medium">
                    <xccdf-1.2:title>Install McAfee Endpoint Security for Linux (ENSL)</xccdf-1.2:title>
                    <xccdf-1.2:description>Install McAfee Endpoint Security for Linux antivirus software
which is provided for DoD systems and uses signatures to search for the
presence of viruses on the filesystem.

The <html:code>McAfeeTP</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install McAfeeTP</html:pre>
          </xccdf-1.2:description>
                    <xccdf-1.2:warning category="general">Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
automated remediation is not available for this configuration check.</xccdf-1.2:warning>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(2)</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
                    <xccdf-1.2:rationale>Virus scanning software can be used to detect if a system has been compromised by
computer viruses, as well as to limit their spread to other systems.</xccdf-1.2:rationale>
                    <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                      <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_mcafeetp_installed:def:1"/>
                    </xccdf-1.2:check>
                    <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                      <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_mcafeetp_installed_ocil:questionnaire:1"/>
                    </xccdf-1.2:check>
                  </xccdf-1.2:Rule>
                  <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_agent_mfetpd_running" severity="medium">
                    <xccdf-1.2:title>Ensure McAfee Endpoint Security for Linux (ENSL) is running</xccdf-1.2:title>
                    <xccdf-1.2:description>Install McAfee Endpoint Security for Linux antivirus software
which is provided for DoD systems and uses signatures to search for the
presence of viruses on the filesystem.</xccdf-1.2:description>
                    <xccdf-1.2:warning category="general">Due to McAfee Endpoint Security for Linux (ENSL) being 3rd party software,
automated remediation is not available for this configuration check.</xccdf-1.2:warning>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(2)</xccdf-1.2:reference>
                    <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
                    <xccdf-1.2:rationale>Virus scanning software can be used to detect if a system has been compromised by
computer viruses, as well as to limit their spread to other systems.</xccdf-1.2:rationale>
                    <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                      <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-agent_mfetpd_running:def:1"/>
                    </xccdf-1.2:check>
                    <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                      <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-agent_mfetpd_running_ocil:questionnaire:1"/>
                    </xccdf-1.2:check>
                  </xccdf-1.2:Rule>
                </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disk_partitioning">
            <xccdf-1.2:title>Disk Partitioning</xccdf-1.2:title>
            <xccdf-1.2:description>To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
<html:code>/</html:code>, <html:code>/boot</html:code>, and <html:code>swap</html:code>.
<html:ul><html:li>If starting with any of the default layouts, check the box to
\"Review and modify partitioning.\" This allows for the easy creation
of additional logical volumes inside the volume group already
created, though it may require making <html:code>/</html:code>'s logical volume smaller to
create space. In general, using logical volumes is preferable to
using partitions because they can be more easily adjusted
later.</html:li><html:li>If creating a custom layout, create the partitions mentioned in
the previous paragraph (which the installer will require anyway),
as well as separate ones described in the following sections.</html:li></html:ul>
If a system has already been installed, and the default
partitioning
scheme was used, it is possible but nontrivial to
modify it to create separate logical volumes for the directories
listed above. The Logical Volume Manager (LVM) makes this possible.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#not_bootc_and_not_container"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_encrypt_partitions" severity="high">
              <xccdf-1.2:title>Encrypt Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>Oracle Linux 9 natively supports partition encryption through the
Linux Unified Key Setup-on-disk-format (LUKS) technology. The easiest way to
encrypt a partition is during installation time.
<html:br/>
        <html:br/>
For manual installations, select the <html:code>Encrypt</html:code> checkbox during
partition creation to encrypt the partition. When this
option is selected the system will prompt for a passphrase to use in
decrypting the partition. The passphrase will subsequently need to be entered manually
every time the system boots.

<html:br/>
        <html:br/>
For automated/unattended installations, it is possible to use Kickstart by adding
the <html:code>--encrypted</html:code> and <html:code>--passphrase=</html:code> options to the definition of each partition to be
encrypted. For example, the following line would encrypt the root partition:
<html:pre>part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=<html:i>PASSPHRASE</html:i>
        </html:pre>
Any <html:i>PASSPHRASE</html:i> is stored in the Kickstart in plaintext, and the Kickstart
must then be protected accordingly.
Omitting the <html:code>--passphrase=</html:code> option from the partition definition will cause the
installer to pause and interactively ask for the passphrase during installation.
<html:br/>
        <html:br/>
By default, the <html:code>Anaconda</html:code> installer uses <html:code>aes-xts-plain64</html:code> cipher
with a minimum <html:code>512</html:code> bit key size which should be compatible with FIPS enabled.

<html:br/>
        <html:br/>
Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on
the Oracle Linux 9 Documentation web site:<html:br/>
        <html:a href="https://docs.oracle.com/en/operating-systems/oracle-linux/9/install/install-InstallingOracleLinuxManually.html#system-options">https://docs.oracle.com/en/operating-systems/oracle-linux/9/install/install-InstallingOracleLinuxManually.html#system-options</html:a>
.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002476</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001199</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002475</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(b)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-28(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000405-GPOS-00184</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000185-GPOS-00079</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000404-GPOS-00183</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.25.SEC-OL1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000001</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002418</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271431r1092616_rule</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271756r1091980_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The risk of a system's physical compromise, particularly mobile systems such as
laptops, places its data at risk of compromise.  Encrypting this data mitigates
the risk of its loss if the system is lost.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-encrypt_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_dev_shm" severity="low">
              <xccdf-1.2:title>Ensure /dev/shm is configured</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/dev/shm</html:code> is a traditional shared memory concept.
One program will create a memory portion, which other processes
(if permitted) can access. If <html:code>/dev/shm</html:code> is not configured,
tmpfs will be mounted to /dev/shm by systemd.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule does not have a remedation.
It is expected that this will be managed by systemd and will be a tmpfs partition.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>Any user can upload and execute files inside the <html:code>/dev/shm</html:code> similar to
the <html:code>/tmp</html:code> partition. Configuring <html:code>/dev/shm</html:code> allows an administrator
to set the noexec option on the mount, making /dev/shm useless for an attacker to
install executable code. It would also prevent an attacker from establishing a
hardlink to a system setuid program and wait for it to be updated. Once the program
was updated, the hardlink would be broken and the attacker would have his own copy
of the program. If the program happened to have a security vulnerability, the attacker
could continue to exploit the known flaw.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_dev_shm:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_dev_shm_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_home" severity="low">
              <xccdf-1.2:title>Ensure /home Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>If user home directories will be stored locally, create a separate partition
for <html:code>/home</html:code> at installation time (or migrate it later using LVM). If
<html:code>/home</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000003</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271433r1091011_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Ensuring that <html:code>/home</html:code> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_home" complexity="low" disruption="high" reboot="false" strategy="enable">
part /home
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_home:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_home_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_srv" severity="unknown">
              <xccdf-1.2:title>Ensure /srv Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>If a file server (FTP, TFTP...) is hosted locally, create a separate partition
for <html:code>/srv</html:code> at installation time (or migrate it later using LVM). If
<html:code>/srv</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Srv deserves files for local network file server such as FTP. Ensuring
that <html:code>/srv</html:code> is mounted on its own partition enables the setting of
more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_srv" complexity="low" disruption="high" reboot="false" strategy="enable">
part /srv
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_srv:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_srv_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_tmp" severity="low">
              <xccdf-1.2:title>Ensure /tmp Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271434r1091014_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code>/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_tmp" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var" severity="low">
              <xccdf-1.2:title>Ensure /var Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/var</html:code> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <html:code>/var</html:code> has its own partition
or logical volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000005</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271435r1091017_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Ensuring that <html:code>/var</html:code> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the <html:code>/var</html:code> directory to contain
world-writable directories installed by other software packages.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_var:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_var_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var_log" severity="low">
              <xccdf-1.2:title>Ensure /var/log Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>System logs are stored in the <html:code>/var/log</html:code> directory.

Ensure that <html:code>/var/log</html:code> has its own partition or logical
volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271436r1091020_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Placing <html:code>/var/log</html:code> in its own partition
enables better separation between log files
and other files in <html:code>/var/</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var_log" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_var_log:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_var_log_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" severity="low">
              <xccdf-1.2:title>Ensure /var/log/audit Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>Audit logs are stored in the <html:code>/var/log/audit</html:code> directory.

Ensure that <html:code>/var/log/audit</html:code> has its own partition or logical
volume at installation time, or migrate it using LVM.
Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000357-CTR-000800</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000002</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271432r1091008_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Placing <html:code>/var/log/audit</html:code> in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var_log_audit" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_var_log_audit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" severity="medium">
              <xccdf-1.2:title>Ensure /var/tmp Located On Separate Partition</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/var/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000007</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271437r1091023_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/var/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code>/var/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="partition_for_var_tmp" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/tmp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-partition_for_var_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-partition_for_var_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_systemd_tmp_mount_enabled" severity="low">
              <xccdf-1.2:title>Ensure tmp.mount Unit Is Enabled</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/tmp</html:code> directory is a world-writable directory used
for temporary file storage. This directory is managed by <html:code>systemd-tmpfiles</html:code>.
Ensure that the <html:code>tmp.mount</html:code> systemd unit is enabled.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/tmp</html:code> directory is used as temporary storage by many programs.
Placing <html:code>/tmp</html:code> in a tmpfs filesystem enables the setting of more
restrictive mount options, which can help protect programs which use it.
The <html:code>tmp.mount</html:code> unit configures the tmpfs filesystem and ensures
the <html:code>/tmp</html:code> directory is wiped during reboot.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="systemd_tmp_mount_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'tmp.mount'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'tmp.mount'
fi
"$SYSTEMCTL_EXEC" enable 'tmp.mount'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="systemd_tmp_mount_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - systemd_tmp_mount_enabled

- name: Enable mount tmp
  ansible.builtin.systemd:
    name: tmp.mount
    enabled: 'yes'
    state: started
    masked: 'false'
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - systemd_tmp_mount_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="systemd_tmp_mount_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">
services --enabled=tmp.mount
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-systemd_tmp_mount_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-systemd_tmp_mount_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome">
            <xccdf-1.2:title>GNOME Desktop Environment</xccdf-1.2:title>
            <xccdf-1.2:description>GNOME is a graphical desktop environment bundled with many Linux distributions that
allow users to easily interact with the operating system graphically rather than
textually. The GNOME Graphical Display Manager (GDM) provides login, logout, and user
switching contexts as well as display server management.
<html:br/>
       <html:br/>
GNOME is developed by the GNOME Project and is considered the default

Oracle Linux Graphical environment.

<html:br/>
       <html:br/>
For more information on GNOME and the GNOME Project, see <html:b><html:a href="https://www.gnome.org">https://www.gnome.org</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#package_gdm"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" severity="high">
              <xccdf-1.2:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</xccdf-1.2:title>
              <xccdf-1.2:description>By default, DConf uses a binary database as a data backend.
The system-level database is compiled from keyfiles in the /etc/dconf/db/
directory by the <html:pre>dconf update</html:pre> command. More specifically, content present
in the following directories:
<html:pre>/etc/dconf/db/local.d</html:pre>
        <html:pre>/etc/dconf/db/local.d</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">reload_dconf_db</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271692r1091788_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unlike text-based keyfiles, the binary database is impossible to check by OVAL.
Therefore, in order to evaluate dconf configuration, both have to be true at the same time -
configuration files have to be compliant, and the database needs to be more recent than those keyfiles,
which gives confidence that it reflects them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_db_up_to_date"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { rpm --quiet -q kernel || rpm --quiet -q kernel-uek; }; then

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_db_up_to_date" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002162
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Run dconf update
  ansible.builtin.command:
    cmd: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002162
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_db_up_to_date:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" severity="high">
              <xccdf-1.2:title>Configure GNOME3 DConf User Profile</xccdf-1.2:title>
              <xccdf-1.2:description>By default, DConf provides a standard user profile. This profile contains a list
of DConf configuration databases. The user profile and database always take the
highest priority. As such the DConf User profile should always exist and be
configured correctly.
<html:br/>
        <html:br/>

To make sure that the user profile is configured correctly, the <html:code>/etc/dconf/profile/user</html:code>
should be set as follows:
<html:pre>user-db:user
system-db:local
system-db:site
system-db:distro
</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale>Failure to have a functional DConf profile prevents GNOME3 configuration settings
from being enforced for all users and allows various security risks.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-enable_dconf_user_profile:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_login_screen">
              <xccdf-1.2:title>Configure GNOME Login Screen</xccdf-1.2:title>
              <xccdf-1.2:description>In the default GNOME desktop, the login is displayed after system boot
and can display user accounts, allow users to reboot the system, and allow users to
login automatically and/or with a guest account. The login screen should be configured
to prevent such behavior.
<html:br/>
        <html:br/>

For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b><html:a href="http://wiki.gnome.org/dconf">http://wiki.gnome.org/dconf</html:a></html:b> and
the man page <html:code>dconf(1)</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" severity="high">
                <xccdf-1.2:title>Disable the GNOME3 Login Restart and Shutdown Buttons</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, users logging directly into the
system are greeted with a login screen that allows any user, known or
unknown, the ability the ability to shutdown or restart the system. This
functionality should be disabled by setting
<html:code>disable-restart-buttons</html:code> to <html:code>true</html:code>.
<html:br/>
         <html:br/>
To disable, add or edit <html:code>disable-restart-buttons</html:code> to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
disable-restart-buttons=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/login-screen/disable-restart-buttons</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002127</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271685r1091767_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271686r1091770_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons
are pressed at the login screen, this can create the risk of short-term loss of availability of systems
due to reboot.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_restart_shutdown"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*disable-restart-buttons\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)disable-restart-buttons(\s*=)/#\1disable-restart-buttons\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/login-screen\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*disable-restart-buttons\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*disable-restart-buttons\\s*=\\s*.*/disable-restart-buttons=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\disable-restart-buttons=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/disable-restart-buttons$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/login-screen/disable-restart-buttons$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/login-screen/disable-restart-buttons$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/login-screen/disable-restart-buttons" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_restart_shutdown" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002127
  - DISA-STIG-OL09-00-002128
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_restart_shutdown
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Disable the GNOME3 Login Restart and Shutdown Buttons
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/login-screen
    option: disable-restart-buttons
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002127
  - DISA-STIG-OL09-00-002128
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_restart_shutdown
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME disablement of Login Restart and Shutdown
    Buttons
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/disable-restart-buttons
    line: /org/gnome/login-screen/disable-restart-buttons
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002127
  - DISA-STIG-OL09-00-002128
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_restart_shutdown
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002127
  - DISA-STIG-OL09-00-002128
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_restart_shutdown
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" severity="medium">
                <xccdf-1.2:title>Disable the GNOME3 Login User List</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, users logging directly into the
system are greeted with a login screen that displays all known users.
This functionality should be disabled by setting <html:code>disable-user-list</html:code>
to <html:code>true</html:code>.
<html:br/>
         <html:br/>
To disable, add or edit <html:code>disable-user-list</html:code> to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
disable-user-list=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/login-screen/disable-user-list</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-23</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002102</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271672r1092631_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Leaving the user list enabled is a security risk since it allows anyone
with physical access to the system to quickly enumerate known user accounts
without logging in.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_user_list"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*disable-user-list\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)disable-user-list(\s*=)/#\1disable-user-list\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/login-screen\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*disable-user-list\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*disable-user-list\\s*=\\s*.*/disable-user-list=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\disable-user-list=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/disable-user-list$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/login-screen/disable-user-list$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/login-screen/disable-user-list$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/login-screen/disable-user-list" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_user_list" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002102
  - NIST-800-53-AC-23
  - NIST-800-53-CM-6(a)
  - dconf_gnome_disable_user_list
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Disable the GNOME3 Login User List
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/login-screen
    option: disable-user-list
    value: 'true'
    no_extra_spaces: true
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002102
  - NIST-800-53-AC-23
  - NIST-800-53-CM-6(a)
  - dconf_gnome_disable_user_list
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME3 disablement of Login User List
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/disable-user-list$
    line: /org/gnome/login-screen/disable-user-list
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002102
  - NIST-800-53-AC-23
  - NIST-800-53-CM-6(a)
  - dconf_gnome_disable_user_list
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002102
  - NIST-800-53-AC-23
  - NIST-800-53-CM-6(a)
  - dconf_gnome_disable_user_list
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_disable_user_list:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal" severity="medium">
                <xccdf-1.2:title>Enable the GNOME3 Screen Locking On Smartcard Removal</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, screen locking on smartcard removal
can be enabled by setting <html:code>removal-action</html:code>
to <html:code>'lock-screen'</html:code>.
<html:br/>
         <html:br/>
To enable, add or edit <html:code>removal-action</html:code> to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/settings-daemon/peripherals/smartcard]
removal-action='lock-screen'</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/settings-daemon/peripherals/smartcard/removal-action</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002160</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271690r1092634_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271684r1091764_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Locking the screen automatically when removing the smartcard can
prevent undesired access to system.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_lock_screen_on_smartcard_removal"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/settings-daemon/peripherals/smartcard\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*removal-action\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)removal-action(\s*=)/#\1removal-action\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/settings-daemon/peripherals/smartcard\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/settings-daemon/peripherals/smartcard]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "'lock-screen'")"
if grep -q "^\\s*removal-action\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*removal-action\\s*=\\s*.*/removal-action=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/settings-daemon/peripherals/smartcard\\]|a\\removal-action=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/settings-daemon/peripherals/smartcard/removal-action" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_lock_screen_on_smartcard_removal" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Detect if removal-action can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/
    contains: ^\s*removal-action
  register: dconf_gnome_lock_screen_on_smartcard_removal_config_files
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Configure removal-action - default file
  ini_file:
    dest: /etc/dconf/db/local.d//00-security-settings
    section: org/gnome/settings-daemon/peripherals/smartcard
    option: removal-action
    value: '''lock-screen'''
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Configure removal-action - existing files
  ini_file:
    dest: '{{ item.path }}'
    section: org/gnome/settings-daemon/peripherals/smartcard
    option: removal-action
    value: '''lock-screen'''
    create: true
  with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_config_files.files
    }}'
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
    &gt; 0
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Detect if lock for removal-action can be found on /etc/dconf/db/local.d/
  find:
    path: /etc/dconf/db/local.d/locks
    contains: ^\s*removal-action
  register: dconf_gnome_lock_screen_on_smartcard_removal_lock_files
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification removal-action - default file
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
    line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification removal-action - existing files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
    line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
    create: true
  with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_lock_files.files }}'
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
    &gt; 0
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update - removal-action
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002126
  - DISA-STIG-OL09-00-002160
  - dconf_gnome_lock_screen_on_smartcard_removal
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" severity="high">
                <xccdf-1.2:title>Disable GDM Automatic Login</xccdf-1.2:title>
                <xccdf-1.2:description>The GNOME Display Manager (GDM) can allow users to automatically login without
user interaction or credentials. User should always be required to authenticate themselves
to the system that they are authorized to use. To disable user ability to automatically
login to the system, set the <html:code>AutomaticLoginEnable</html:code> to <html:code>false</html:code> in the
<html:code>[daemon]</html:code> section in <html:code>/etc/gdm/custom.conf</html:code>. For example:
<html:pre>[daemon]
AutomaticLoginEnable=false</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002161</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271691r1091785_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Failure to restrict system access to authenticated users negatively impacts operating
system security.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="gnome_gdm_disable_automatic_login"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

if rpm --quiet -q gdm
then
	if ! grep -q "^AutomaticLoginEnable=" /etc/gdm/custom.conf
	then
		sed -i "/^\[daemon\]/a \
		AutomaticLoginEnable=False" /etc/gdm/custom.conf
	else
		sed -i "s/^AutomaticLoginEnable=.*/AutomaticLoginEnable=False/g" /etc/gdm/custom.conf
	fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="gnome_gdm_disable_automatic_login" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002161
  - NIST-800-171-3.1.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - gnome_gdm_disable_automatic_login
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Disable GDM Automatic Login
  ini_file:
    dest: /etc/gdm/custom.conf
    section: daemon
    option: AutomaticLoginEnable
    value: 'false'
    no_extra_spaces: true
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002161
  - NIST-800-171-3.1.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - gnome_gdm_disable_automatic_login
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-gnome_gdm_disable_automatic_login:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_xdmcp" severity="high">
                <xccdf-1.2:title>Disable XDMCP in GDM</xccdf-1.2:title>
                <xccdf-1.2:description>XDMCP is an unencrypted protocol, and therefore, presents a security risk, see e.g.
<html:a href="https://help.gnome.org/admin/gdm/stable/security.html.en_GB#xdmcpsecurity">XDMCP Gnome docs</html:a>.

To disable XDMCP support in Gnome, set <html:code>Enable</html:code> to <html:code>false</html:code> under the <html:code>[xdmcp]</html:code> configuration section in <html:code>/etc/gdm/custom.conf</html:code>. For example:
<html:pre>
[xdmcp]
Enable=false
</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:rationale>XDMCP provides unencrypted remote access through the Gnome Display Manager (GDM) which does
not provide for the confidentiality and integrity of user passwords or the
remote session. If a privileged user were to login using XDMCP, the
privileged user password could be compromised due to typed XEvents
and keystrokes will traversing over the network in clear text.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="gnome_gdm_disable_xdmcp"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Try find '[xdmcp]' and 'Enable' in '/etc/gdm/custom.conf', if it exists, set
# to 'false', if it isn't here, add it, if '[xdmcp]' doesn't exist, add it there
if grep -qzosP '[[:space:]]*\[xdmcp]([^\n\[]*\n+)+?[[:space:]]*Enable' '/etc/gdm/custom.conf'; then
    
    sed -i "s/Enable[^(\n)]*/Enable=false/" '/etc/gdm/custom.conf'
elif grep -qs '[[:space:]]*\[xdmcp]' '/etc/gdm/custom.conf'; then
    sed -i "/[[:space:]]*\[xdmcp]/a Enable=false" '/etc/gdm/custom.conf'
else
    if test -d "/etc/gdm"; then
        printf '%s\n' '[xdmcp]' "Enable=false" &gt;&gt; '/etc/gdm/custom.conf'
    else
        echo "Config file directory '/etc/gdm' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="gnome_gdm_disable_xdmcp" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - gnome_gdm_disable_xdmcp
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Disable XDMCP in GDM
  ini_file:
    path: /etc/gdm/custom.conf
    section: xdmcp
    option: Enable
    value: 'false'
    create: true
    mode: 420
  when: '"gdm" in ansible_facts.packages'
  tags:
  - gnome_gdm_disable_xdmcp
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-gnome_gdm_disable_xdmcp:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-gnome_gdm_disable_xdmcp_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_media_settings">
              <xccdf-1.2:title>GNOME Media Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME media settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" severity="medium">
                <xccdf-1.2:title>Disable GNOME3 Automounting</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount within GNOME3, add or set
<html:code>automount</html:code> to <html:code>false</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/media-handling]
automount=false</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/media-handling/automount</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_automount"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*automount\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)automount(\s*=)/#\1automount\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/media-handling\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
if grep -q "^\\s*automount\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*automount\\s*=\\s*.*/automount=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/media-handling/automount$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/media-handling/automount$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/media-handling/automount" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_automount" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Disable GNOME3 Automounting - automount
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: automount
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - automount
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/automount$
    line: /org/gnome/desktop/media-handling/automount
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_disable_automount:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open" severity="medium">
                <xccdf-1.2:title>Disable GNOME3 Automount Opening</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable automount-open within GNOME3, add or set
<html:code>automount-open</html:code> to <html:code>false</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/media-handling]
automount-open=false</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/media-handling/automount-open</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002120</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271670r1091722_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271678r1091746_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Disabling automatic mounting in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_automount_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*automount-open\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)automount-open(\s*=)/#\1automount-open\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/media-handling\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "false")"
if grep -q "^\\s*automount-open\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*automount-open\\s*=\\s*.*/automount-open=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount-open=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount-open$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/media-handling/automount-open$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/media-handling/automount-open$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/media-handling/automount-open" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_automount_open" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002100
  - DISA-STIG-OL09-00-002120
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount_open
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Disable GNOME3 Automounting - automount-open
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: automount-open
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002100
  - DISA-STIG-OL09-00-002120
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount_open
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - automount-open
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/automount-open$
    line: /org/gnome/desktop/media-handling/automount-open
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002100
  - DISA-STIG-OL09-00-002120
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount_open
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002100
  - DISA-STIG-OL09-00-002120
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - dconf_gnome_disable_automount_open
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_disable_automount_open:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_disable_automount_open_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun" severity="low">
                <xccdf-1.2:title>Disable GNOME3 Automount running</xccdf-1.2:title>
                <xccdf-1.2:description>The system's default desktop environment, GNOME3, will mount
devices and removable media (such as DVDs, CDs and USB flash drives) whenever
they are inserted into the system. To disable autorun-never within GNOME3, add or set
<html:code>autorun-never</html:code> to <html:code>true</html:code> in <html:code>/etc/dconf/db/local.d/00-security-settings</html:code>.
For example:
<html:pre>[org/gnome/desktop/media-handling]
autorun-never=true</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/media-handling/autorun-never</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002101</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002121</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271671r1091725_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271679r1091749_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Disabling automatic mount running in GNOME3 can prevent
the introduction of malware via removable media.
It will, however, also prevent desktop users from legitimate use
of removable media.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_autorun"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/media-handling\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*autorun-never\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)autorun-never(\s*=)/#\1autorun-never\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/media-handling\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/media-handling]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*autorun-never\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*autorun-never\\s*=\\s*.*/autorun-never=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\autorun-never=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/autorun-never$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/media-handling/autorun-never$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/media-handling/autorun-never$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/media-handling/autorun-never" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_autorun" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002101
  - DISA-STIG-OL09-00-002121
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_autorun
  - low_complexity
  - low_severity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Disable GNOME3 Automounting - autorun-never
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/media-handling
    option: autorun-never
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002101
  - DISA-STIG-OL09-00-002121
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_autorun
  - low_complexity
  - low_severity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME3 Automounting - autorun-never
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/media-handling/autorun-never$
    line: /org/gnome/desktop/media-handling/autorun-never
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002101
  - DISA-STIG-OL09-00-002121
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_autorun
  - low_complexity
  - low_severity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002101
  - DISA-STIG-OL09-00-002121
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_autorun
  - low_complexity
  - low_severity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_disable_autorun:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_disable_autorun_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_remote_access_settings">
              <xccdf-1.2:title>GNOME Remote Access Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME remote access settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" severity="medium">
                <xccdf-1.2:title>Require Credential Prompting for Remote Access in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> does not require credentials when using <html:code>Vino</html:code> for
remote access. To configure the system to require remote credentials, add or set
<html:code>authentication-methods</html:code> to <html:code>['vnc']</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/Vino]
authentication-methods=['vnc']
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/Vino/authentication-methods</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Username and password prompting is required for remote access. Otherwise, non-authorized
and nefarious users can access the system freely.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_remote_access_credential_prompt"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/Vino\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*authentication-methods\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)authentication-methods(\s*=)/#\1authentication-methods\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/Vino\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/Vino]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "['vnc']")"
if grep -q "^\\s*authentication-methods\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*authentication-methods\\s*=\\s*.*/authentication-methods=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/Vino\\]|a\\authentication-methods=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/Vino/authentication-methods$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/Vino/authentication-methods$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/Vino/authentication-methods$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/Vino/authentication-methods" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_remote_access_credential_prompt" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.12
  - dconf_gnome_remote_access_credential_prompt
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Require Credential Prompting for Remote Access in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/Vino
    option: authentication-methods
    value: '[''vnc'']'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.12
  - dconf_gnome_remote_access_credential_prompt
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME3 Credential Prompting for Remote Access
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/Vino/authentication-methods$
    line: /org/gnome/Vino/authentication-methods
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.12
  - dconf_gnome_remote_access_credential_prompt
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.12
  - dconf_gnome_remote_access_credential_prompt
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" severity="medium">
                <xccdf-1.2:title>Require Encryption for Remote Access in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> requires encryption when using <html:code>Vino</html:code> for remote access.
To prevent remote access encryption from being disabled, add or set
<html:code>require-encryption</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/Vino]
require-encryption=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/Vino/require-encryption</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.08</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI07.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Open X displays allow an attacker to capture keystrokes and to execute commands
remotely.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_remote_access_encryption"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/Vino\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*require-encryption\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)require-encryption(\s*=)/#\1require-encryption\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/Vino\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/Vino]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*require-encryption\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*require-encryption\\s*=\\s*.*/require-encryption=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/Vino\\]|a\\require-encryption=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/Vino/require-encryption$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/Vino/require-encryption$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/Vino/require-encryption$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/Vino/require-encryption" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_remote_access_encryption" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - dconf_gnome_remote_access_encryption
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Require Encryption for Remote Access in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/Vino
    option: require-encryption
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - dconf_gnome_remote_access_encryption
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME3 Encryption for Remote Access
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/Vino/require-encryption$
    line: /org/gnome/Vino/require-encryption
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - dconf_gnome_remote_access_encryption
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - dconf_gnome_remote_access_encryption
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_remote_access_encryption:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_screen_locking">
              <xccdf-1.2:title>Configure GNOME Screen Locking</xccdf-1.2:title>
              <xccdf-1.2:description>In the default GNOME3 desktop, the screen can be locked
by selecting the user name in the far right corner of the main panel and
selecting <html:b>Lock</html:b>.
<html:br/>
        <html:br/>
The following sections detail commands to enforce idle activation of the screensaver,
screen locking, a blank-screen screensaver, and an idle activation time.
<html:br/>
        <html:br/>
Because users should be trained to lock the screen when they
step away from the computer, the automatic locking feature is only
meant as a backup.
<html:br/>
        <html:br/>
The root account can be screen-locked; however, the root account should
<html:i>never</html:i> be used to log into an X Windows environment and should only
be used to for direct login via console in emergency circumstances.
<html:br/>
        <html:br/>
For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b><html:a href="http://wiki.gnome.org/dconf">http://wiki.gnome.org/dconf</html:a></html:b> and
the man page <html:code>dconf(1)</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_inactivity_timeout_value" type="number">
                <xccdf-1.2:title>Screensaver Inactivity timeout</xccdf-1.2:title>
                <xccdf-1.2:description>Choose allowed duration (in seconds) of inactive graphical sessions</xccdf-1.2:description>
                <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
                <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
                <xccdf-1.2:value>900</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" type="number">
                <xccdf-1.2:title>Screensaver Lock Delay</xccdf-1.2:title>
                <xccdf-1.2:description>Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt</xccdf-1.2:description>
                <xccdf-1.2:value selector="10_seconds">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="5_seconds">5</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="immediate">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" severity="medium">
                <xccdf-1.2:title>Enable GNOME3 Screensaver Idle Activation</xccdf-1.2:title>
                <xccdf-1.2:description>To activate the screensaver in the GNOME3 desktop after a period of inactivity,
add or set <html:code>idle-activation-enabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
idle-activation-enabled=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock.
<html:br/>
         <html:br/>
Enabling idle activation of the screensaver ensures the screensaver will
be activated after the idle delay.  Applications requiring continuous,
real-time screen display (such as network management products) require the
login session does not have administrator rights and the display station is located in a
controlled-access area.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_idle_activation_enabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*idle-activation-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)idle-activation-enabled(\s*=)/#\1idle-activation-enabled\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/screensaver\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*idle-activation-enabled\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*idle-activation-enabled\\s*=\\s*.*/idle-activation-enabled=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\idle-activation-enabled=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/screensaver/idle-activation-enabled$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/screensaver/idle-activation-enabled$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/screensaver/idle-activation-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_idle_activation_enabled" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.5
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_activation_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Enable GNOME3 Screensaver Idle Activation
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: idle-activation-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_activation_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME idle-activation-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled$
    line: /org/gnome/desktop/screensaver/idle-activation-enabled
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_activation_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_activation_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" severity="medium">
                <xccdf-1.2:title>Set GNOME3 Screensaver Inactivity Timeout</xccdf-1.2:title>
                <xccdf-1.2:description>The idle time-out value for inactivity in the GNOME3 desktop is configured via the <html:code>idle-delay</html:code>
setting must be set under an appropriate configuration file(s) in the <html:code>/etc/dconf/db/local.d</html:code> directory
and locked in <html:code>/etc/dconf/db/local.d/locks</html:code> directory to prevent user modification.
<html:br/>
         <html:br/>
For example, to configure the system for a 15 minute delay, add the following to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>:
<html:pre>[org/gnome/desktop/session]
idle-delay=uint32 900</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002104</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271674r1091734_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from
the immediate physical vicinity of the information system but does not logout because of the
temporary nature of the absence. Rather than relying on the user to manually lock their operating
system session prior to vacating the vicinity, GNOME3 can be configured to identify when
a user's session has idled and take action to initiate a session lock.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_idle_delay"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

inactivity_timeout_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>'


# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/session\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*idle-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)idle-delay(\s*=)/#\1idle-delay\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/session\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/session]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${inactivity_timeout_value}")"
if grep -q "^\\s*idle-delay\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*idle-delay\\s*=\\s*.*/idle-delay=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/session\\]|a\\idle-delay=${escaped_value}" "${DCONFFILE}"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_idle_delay" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002104
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_delay
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value inactivity_timeout_value # promote to variable
  set_fact:
    inactivity_timeout_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set GNOME3 Screensaver Inactivity Timeout
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/session
    option: idle-delay
    value: uint32 {{ inactivity_timeout_value }}
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002104
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_delay
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002104
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_idle_delay
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-inactivity_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_inactivity_timeout_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" severity="medium">
                <xccdf-1.2:title>Set GNOME3 Screensaver Lock Delay After Activation Period</xccdf-1.2:title>
                <xccdf-1.2:description>To activate the locking delay of the screensaver in the GNOME3 desktop when
the screensaver is activated, add or set <html:code>lock-delay</html:code> to <html:code>uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>
         </html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
lock-delay=uint32 <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>
         </html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002103</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271673r1091731_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_lock_delay"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

var_screensaver_lock_delay='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>'


# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*lock-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)lock-delay(\s*=)/#\1lock-delay\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/screensaver\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${var_screensaver_lock_delay}")"
if grep -q "^\\s*lock-delay\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*lock-delay\\s*=\\s*.*/lock-delay=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-delay=${escaped_value}" "${DCONFFILE}"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_lock_delay" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002103
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_delay
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value var_screensaver_lock_delay # promote to variable
  set_fact:
    var_screensaver_lock_delay: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" use="legacy"/>
  tags:
    - always

- name: Set GNOME3 Screensaver Lock Delay After Activation Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-delay
    value: uint32 {{ var_screensaver_lock_delay }}
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002103
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_delay
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002103
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_delay
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_screensaver_lock_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" severity="medium">
                <xccdf-1.2:title>Enable GNOME3 Screensaver Lock After Idle Period</xccdf-1.2:title>
                <xccdf-1.2:description>
To activate locking of the screensaver in the GNOME3 desktop when it is activated,
add or set <html:code>lock-enabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
lock-enabled=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/lock-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002123</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271681r1091755_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_lock_enabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*lock-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)lock-enabled(\s*=)/#\1lock-enabled\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/screensaver\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*lock-enabled\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*lock-enabled\\s*=\\s*.*/lock-enabled=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-enabled=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/screensaver/lock-enabled$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/screensaver/lock-enabled$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/screensaver/lock-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_lock_enabled" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution == 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Enable GNOME3 Screensaver Lock After Idle Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution != 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME lock-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
    line: /org/gnome/desktop/screensaver/lock-enabled
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution != 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Enable GNOME3 Screensaver Lock After Idle Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/lockdown
    option: disable-lock-screen
    value: 'false'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution == 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME disable-lock-screen
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/lockdown/disable-lock-screen$
    line: /org/gnome/desktop/lockdown/disable-lock-screen
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution == 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Check GNOME3 screenserver disable-lock-screen false
  command: gsettings get org.gnome.desktop.lockdown disable-lock-screen
  register: cmd_out
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution == 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Update GNOME3 screenserver disable-lock-screen false
  command: gsettings set org.gnome.desktop.lockdown disable-lock-screen false
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_distribution == 'SLES'
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002123
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_lock_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" severity="medium">
                <xccdf-1.2:title>Implement Blank Screensaver</xccdf-1.2:title>
                <xccdf-1.2:description>


To set the screensaver mode in the GNOME3 desktop to a blank screen,
add or set <html:code>picture-uri</html:code> to <html:code>string ''</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
picture-uri=string ''
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/picture-uri</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002106</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271676r1091740_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting the screensaver mode to blank-only conceals the
contents of the display from passersby.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_mode_blank"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*picture-uri\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)picture-uri(\s*=)/#\1picture-uri\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/desktop/screensaver\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "string ''")"
if grep -q "^\\s*picture-uri\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*picture-uri\\s*=\\s*.*/picture-uri=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\picture-uri=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/picture-uri$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/screensaver/picture-uri$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/screensaver/picture-uri$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/screensaver/picture-uri" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_mode_blank" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002106
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(1)
  - NIST-800-53-AC-11(1).1
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_mode_blank
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Implement Blank Screensaver
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: picture-uri
    value: string ''
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002106
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(1)
  - NIST-800-53-AC-11(1).1
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_mode_blank
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME picture-uri
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/picture-uri$
    line: /org/gnome/desktop/screensaver/picture-uri
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002106
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(1)
  - NIST-800-53-AC-11(1).1
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_mode_blank
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CJIS-5.5.5
  - DISA-STIG-OL09-00-002106
  - NIST-800-171-3.1.10
  - NIST-800-53-AC-11(1)
  - NIST-800-53-AC-11(1).1
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_screensaver_mode_blank
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" severity="medium">
                <xccdf-1.2:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</xccdf-1.2:title>
                <xccdf-1.2:description>If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding <html:code>/org/gnome/desktop/screensaver/lock-delay</html:code>
to <html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/lock-delay</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002125</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271683r1091761_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_screensaver_user_locks"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-delay$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/screensaver/lock-delay$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/screensaver/lock-delay$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/screensaver/lock-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_screensaver_user_locks" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002125
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - dconf_gnome_screensaver_user_locks
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME lock-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-delay$
    line: /org/gnome/desktop/screensaver/lock-delay
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002125
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - dconf_gnome_screensaver_user_locks
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002125
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - dconf_gnome_screensaver_user_locks
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_screensaver_user_locks:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_screensaver_user_locks_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" severity="medium">
                <xccdf-1.2:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</xccdf-1.2:title>
                <xccdf-1.2:description>If not already configured, ensure that users cannot change GNOME3 session idle settings
by adding <html:code>/org/gnome/desktop/session/idle-delay</html:code>
to <html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/session/idle-delay</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002124</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271682r1091758_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_session_idle_user_locks"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/session/idle-delay$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/desktop/session/idle-delay$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/desktop/session/idle-delay$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/desktop/session/idle-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_session_idle_user_locks" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002124
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_session_idle_user_locks
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME Session idle-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/session/idle-delay$
    line: /org/gnome/desktop/session/idle-delay
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002124
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_session_idle_user_locks
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002124
  - NIST-800-171-3.1.10
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_gnome_session_idle_user_locks
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_session_idle_user_locks:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_session_idle_user_locks_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_system_settings">
              <xccdf-1.2:title>GNOME System Settings</xccdf-1.2:title>
              <xccdf-1.2:description>GNOME provides configuration and functionality to a graphical desktop environment
that changes grahical configurations or allow a user to perform
actions that users normally would not be able to do in non-graphical mode such as
remote access configuration, power policies, Geo-location, etc.
Configuring such settings in GNOME will prevent accidential graphical configuration
changes by users from taking place.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" severity="high">
                <xccdf-1.2:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</xccdf-1.2:title>
                <xccdf-1.2:description>By default, <html:code>GNOME</html:code> will reboot the system if the
<html:code>Ctrl-Alt-Del</html:code> key sequence is pressed.
<html:br/>
         <html:br/>
To configure the system to ignore the <html:code>Ctrl-Alt-Del</html:code> key sequence
from the Graphical User Interface (GUI) instead of rebooting the system,
add or set <html:code>logout</html:code> to <html:code>['']</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/settings-daemon/plugins/media-keys]
logout=['']</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent
user modification. For example:
<html:pre>/org/gnome/settings-daemon/plugins/media-keys/logout</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002107</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002129</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271677r1091743_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271687r1091773_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#machine"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_disable_ctrlaltdel_reboot"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/settings-daemon/plugins/media-keys\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*logout\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)logout(\s*=)/#\1logout\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/settings-daemon/plugins/media-keys\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/settings-daemon/plugins/media-keys]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "['']")"
if grep -q "^\\s*logout\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*logout\\s*=\\s*.*/logout=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/settings-daemon/plugins/media-keys\\]|a\\logout=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/plugins/media-keys/logout$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/settings-daemon/plugins/media-keys/logout$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/settings-daemon/plugins/media-keys/logout$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/settings-daemon/plugins/media-keys/logout" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_disable_ctrlaltdel_reboot" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002107
  - DISA-STIG-OL09-00-002129
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_ctrlaltdel_reboot
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/settings-daemon/plugins/media-keys
    option: logout
    value: '['''']'
    create: true
    no_extra_spaces: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002107
  - DISA-STIG-OL09-00-002129
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_ctrlaltdel_reboot
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME disablement of Ctrl-Alt-Del
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/settings-daemon/plugins/media-keys/logout$
    line: /org/gnome/settings-daemon/plugins/media-keys/logout
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002107
  - DISA-STIG-OL09-00-002129
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_ctrlaltdel_reboot
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-002107
  - DISA-STIG-OL09-00-002129
  - NIST-800-171-3.1.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - dconf_gnome_disable_ctrlaltdel_reboot
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sudo">
            <xccdf-1.2:title>Sudo</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>Sudo</html:code>, which stands for "su 'do'", provides the ability to delegate authority
to certain users, groups of users, or system administrators. When configured for system
users and/or groups, <html:code>Sudo</html:code> can allow a user or group to execute privileged commands
that normally only <html:code>root</html:code> is allowed to execute.
<html:br/>
       <html:br/>
For more information on <html:code>Sudo</html:code> and addition <html:code>Sudo</html:code> configuration options, see
<html:b><html:a href="https://www.sudo.ws">https://www.sudo.ws</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group" type="string" interactive="true">
              <xccdf-1.2:title>Group name dedicated to the use of sudo</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the name of the group that should own /usr/bin/sudo.</xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
              <xccdf-1.2:value selector="sudogrp">sudogrp</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_logfile" type="string" interactive="true">
              <xccdf-1.2:title>Sudo - logfile value</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the sudo logfile to use. The default value used here matches the example
location from CIS, which uses /var/log/sudo.log.</xccdf-1.2:description>
              <xccdf-1.2:value>/var/log/sudo.log</xccdf-1.2:value>
              <xccdf-1.2:value selector="var_log_sudo_log">/var/log/sudo.log</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" type="string">
              <xccdf-1.2:title>Sudo - timestamp_timeout value</xccdf-1.2:title>
              <xccdf-1.2:description>Defines the number of minutes that can elapse before <html:code>sudo</html:code> will ask for a passwd again.
If set to a value less than 0 the user's time stamp will never expire. Defining 0 means always prompt for a 
password. The default timeout value is 5 minutes.</xccdf-1.2:description>
              <xccdf-1.2:value>5</xccdf-1.2:value>
              <xccdf-1.2:value selector="always_prompt">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1_minute">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2_minutes">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3_minutes">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_minutes">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_minutes">15</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_umask" type="string">
              <xccdf-1.2:title>Sudo - umask value</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the sudo umask to use. The actual umask value that is used is the union
of the user's umask and the sudo umask.
The default sudo umask is 0022. This guarantess sudo never lowers the umask when
running a command.</xccdf-1.2:description>
              <xccdf-1.2:value>0022</xccdf-1.2:value>
              <xccdf-1.2:value selector="0022">0022</xccdf-1.2:value>
              <xccdf-1.2:value selector="0027">0027</xccdf-1.2:value>
              <xccdf-1.2:value selector="0077">0077</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_sudo_installed" severity="medium">
              <xccdf-1.2:title>Install sudo Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>sudo</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install sudo</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1382</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271474r1091134_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>sudo</html:code> is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "sudo" ; then
    yum install -y "sudo"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000230
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sudo_installed

- name: Ensure sudo is installed
  package:
    name: sudo
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000230
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sudo_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_sudo

class install_sudo {
  package { 'sudo':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_sudo_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=sudo
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_sudo_installed">
[[packages]]
name = "sudo"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_sudo_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_sudo_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_groupowner_etc_sudoersd" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/sudoers.d Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/sudoers.d</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/sudoers.d</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/sudoers.d directory by the root group is important
because this directory hosts sudo configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the sudo configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_groupowner_etc_sudoersd" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /etc/sudoers.d/ -maxdepth 1 -type d -exec chgrp -L root {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_groupowner_etc_sudoersd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure group owner on /etc/sudoers.d/
  file:
    path: /etc/sudoers.d/
    state: directory
    group: root
  tags:
  - configure_strategy
  - directory_groupowner_etc_sudoersd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_groupowner_etc_sudoersd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_groupowner_etc_sudoersd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_owner_etc_sudoersd" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/sudoers.d Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/sudoers.d</html:code>, run the command: <html:pre>$ sudo chown root /etc/sudoers.d </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/sudoers.d directory by the root user is important
because this directory hosts sudo configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the sudo configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_owner_etc_sudoersd" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /etc/sudoers.d/ -maxdepth 1 -type d -exec chown -L 0 {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_owner_etc_sudoersd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /etc/sudoers.d/
  file:
    path: /etc/sudoers.d/
    state: directory
    owner: '0'
  tags:
  - configure_strategy
  - directory_owner_etc_sudoersd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_owner_etc_sudoersd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_owner_etc_sudoersd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_etc_sudoersd" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/sudoers.d Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/sudoers.d</html:code>, run the command: <html:pre>$ sudo chmod 0750 /etc/sudoers.d</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/sudoers.d directory is important
because this directory hosts sudo configuration. Protection of this
directory is critical for system security. Restricting the permissions
ensures exclusive control of the sudo configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_etc_sudoersd" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /etc/sudoers.d/ -maxdepth 1 -perm /u+s,g+ws,o+xwrt -type d -exec chmod u-s,g-ws,o-xwrt {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_permissions_etc_sudoersd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /etc/sudoers.d/ file(s)
  command: 'find -H /etc/sudoers.d/ -maxdepth 1 -perm /u+s,g+ws,o+xwrt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - directory_permissions_etc_sudoersd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/sudoers.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - directory_permissions_etc_sudoersd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_etc_sudoersd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_etc_sudoersd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_sudoers" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/sudoers File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/sudoers</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/sudoers</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/sudoers file by the root group is important
because this file hosts sudo configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the sudo configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_sudoers" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp root /etc/sudoers
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_sudoers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/sudoers
  stat:
    path: /etc/sudoers
  register: file_exists
  tags:
  - configure_strategy
  - file_groupowner_etc_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner root on /etc/sudoers
  file:
    path: /etc/sudoers
    group: root
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_sudoers:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_sudoers_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_sudoers" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/sudoers File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/sudoers</html:code>, run the command: <html:pre>$ sudo chown root /etc/sudoers </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/sudoers file by the root user is important
because this file hosts sudo configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the sudo configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_sudoers" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/sudoers
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_sudoers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/sudoers
  stat:
    path: /etc/sudoers
  register: file_exists
  tags:
  - configure_strategy
  - file_owner_etc_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/sudoers
  file:
    path: /etc/sudoers
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_sudoers:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_sudoers_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_sudoers" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/sudoers File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/sudoers</html:code>, run the command: <html:pre>$ sudo chmod 0440 /etc/sudoers</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/sudoers file is important
because this file hosts sudo configuration. Protection of this
file is critical for system security. Restricting the permissions
ensures exclusive control of the sudo configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_sudoers" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xws,g-xws,o-xwrt /etc/sudoers
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_sudoers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/sudoers
  stat:
    path: /etc/sudoers
  register: file_exists
  tags:
  - configure_strategy
  - file_permissions_etc_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xws,g-xws,o-xwrt on /etc/sudoers
  file:
    path: /etc/sudoers
    mode: u-xws,g-xws,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_sudoers:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_sudoers_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_sudo" severity="medium">
              <xccdf-1.2:title>Ensure That the sudo Binary Has the Correct Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the permissions of <html:code>/usr/bin/sudo</html:code>, run the command:
<html:pre>$ sudo chmod 4111 /usr/bin/sudo</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R38</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The sudoers program should only be usable by people who have the correct permissions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_sudo" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then

chmod 4110 /usr/bin/sudo

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_sudo" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /usr/bin/sudo
  stat:
    path: /usr/bin/sudo
  register: file_exists
  when: '"sudo" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission 4110 on /usr/bin/sudo
  file:
    path: /usr/bin/sudo
    mode: '4110'
  when:
  - '"sudo" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_sudo:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_add_noexec" severity="high">
              <xccdf-1.2:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOEXEC</html:code> tag, when specified, prevents user executed
commands from executing other commands, like a shell for example.
This should be enabled by making sure that the <html:code>NOEXEC</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R39</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Restricting the capability of sudo allowed commands to execute sub-commands
prevents users from running programs with privileges they wouldn't have otherwise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_add_noexec" complexity="low" disruption="low" reboot="false" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults[\s]*\bnoexec\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option noexec
        echo "Defaults noexec" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_add_noexec" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure noexec is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\bnoexec\b.*$
    line: Defaults noexec
    validate: /usr/sbin/visudo -cf %s
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_noexec
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_add_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_add_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_add_requiretty" severity="medium">
              <xccdf-1.2:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>requiretty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code>requiretty</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R39</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Restricting the use cases in which a user is allowed to execute sudo commands
reduces the attack surface.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_add_requiretty" complexity="low" disruption="low" reboot="false" strategy="restrict">
if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults[\s]*\brequiretty\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option requiretty
        echo "Defaults requiretty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_add_requiretty" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure requiretty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\brequiretty\b.*$
    line: Defaults requiretty
    validate: /usr/sbin/visudo -cf %s
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_requiretty
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_add_requiretty:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" severity="medium">
              <xccdf-1.2:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>use_pty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code>use_pty</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R39</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining
access to the user's terminal after the main program has finished executing.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_add_use_pty" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then

if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults[\s]*\buse_pty\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option use_pty
        echo "Defaults use_pty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_add_use_pty" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_use_pty

- name: Ensure use_pty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\buse_pty\b.*$
    line: Defaults use_pty
    validate: /usr/sbin/visudo -cf %s
  when: '"sudo" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_use_pty
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_add_use_pty:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" severity="low">
              <xccdf-1.2:title>Ensure Sudo Logfile Exists - sudo logfile</xccdf-1.2:title>
              <xccdf-1.2:description>A custom log sudo file can be configured with the 'logfile' tag. This rule configures
a sudo custom logfile at the default location suggested by CIS, which uses
/var/log/sudo.log.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A sudo log file simplifies auditing of sudo commands.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_custom_logfile" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then

var_sudo_logfile='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_logfile" use="legacy"/>'


if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults[\s]*\blogfile\s*=\s*(?:"?([^",\s]+)"?)\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option logfile
        echo "Defaults logfile=${var_sudo_logfile}" &gt;&gt; /etc/sudoers
    else
        # sudoers file defines Option logfile, remediate if appropriate value is not set
        if ! grep -P "^[\s]*Defaults.*\blogfile=${var_sudo_logfile}\b.*$" /etc/sudoers; then
            
            escaped_variable=${var_sudo_logfile//$'/'/$'\/'}
            sed -Ei "s/(^[\s]*Defaults.*\blogfile=)[-]?.+(\b.*$)/\1$escaped_variable\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_custom_logfile" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_custom_logfile
- name: XCCDF Value var_sudo_logfile # promote to variable
  set_fact:
    var_sudo_logfile: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_logfile" use="legacy"/>
  tags:
    - always

- name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\blogfile=[-]?.+\b(.*)$
    line: Defaults \1logfile={{ var_sudo_logfile }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_logfile_option
  when: '"sudo" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_custom_logfile

- name: Enable logfile option with appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    line: Defaults logfile={{ var_sudo_logfile }}
    validate: /usr/sbin/visudo -cf %s
  when:
  - '"sudo" in ansible_facts.packages'
  - edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_custom_logfile
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sudo_logfile:var:1" value-id="xccdf_org.ssgproject.content_value_var_sudo_logfile"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_custom_logfile:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_custom_logfile_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_dedicated_group" severity="medium">
              <xccdf-1.2:title>Ensure a dedicated group owns sudo</xccdf-1.2:title>
              <xccdf-1.2:description>Restrict the execution of privilege escalated commands to a dedicated group of users.
Ensure the group owner of /usr/bin/sudo is <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group" use="legacy"/>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">Changing group owner of <html:code>/usr/bin/sudo</html:code> to a group with no member users will prevent
any and all escalatation of privileges.
Additionally, the system may become unmanageable if root logins are not allowed.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, before remediating the sysadmin needs to add users to the dedicated sudo group.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R38</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Restricting the set of users able to execute commands as privileged user reduces the attack surface.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sudo_dedicated_group:var:1" value-id="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_dedicated_group:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_dedicated_group_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" severity="medium">
              <xccdf-1.2:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>!authenticate</html:code> option, when specified, allows a user to execute commands using
sudo without having to authenticate. This should be disabled by making sure that the
<html:code>!authenticate</html:code> option does not exist in <html:code>/etc/sudoers</html:code> configuration file or
any sudo configuration snippets in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004895</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002362</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271724r1091884_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/>
        <html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_remove_no_authenticate" complexity="low" disruption="low" reboot="false" strategy="restrict">
for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "!authenticate" matches to preserve user data
      sed -i "s|^${entry}$|# &amp;|g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_remove_no_authenticate" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/sudoers.d/ files
  ansible.builtin.find:
    paths:
    - /etc/sudoers.d/
  register: sudoers
  tags:
  - DISA-STIG-OL09-00-002362
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_no_authenticate

- name: Remove lines containing !authenticate from sudoers files
  ansible.builtin.replace:
    regexp: (^(?!#).*[\s]+\!authenticate.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
  - path: /etc/sudoers
  - '{{ sudoers.files }}'
  tags:
  - DISA-STIG-OL09-00-002362
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_no_authenticate
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_remove_no_authenticate:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" severity="medium">
              <xccdf-1.2:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOPASSWD</html:code> tag, when specified, allows a user to execute
commands using sudo without having to authenticate. This should be disabled
by making sure that the <html:code>NOPASSWD</html:code> tag does not exist in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004895</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002363</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271725r1091887_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/>
        <html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_remove_nopasswd" complexity="low" disruption="low" reboot="false" strategy="restrict">
for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s|^${entry}$|# &amp;|g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_remove_nopasswd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/sudoers.d/ files
  ansible.builtin.find:
    paths:
    - /etc/sudoers.d/
  register: sudoers
  tags:
  - DISA-STIG-OL09-00-002363
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_nopasswd

- name: Remove lines containing NOPASSWD from sudoers files
  ansible.builtin.replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
  - path: /etc/sudoers
  - '{{ sudoers.files }}'
  tags:
  - DISA-STIG-OL09-00-002363
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_remove_nopasswd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_remove_nopasswd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_require_authentication" severity="medium">
              <xccdf-1.2:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOPASSWD</html:code> and <html:code>!authenticate</html:code> option, when
specified, allows a user to execute commands using sudo without having to
authenticate. This should be disabled by making sure that
<html:code>NOPASSWD</html:code> and/or <html:code>!authenticate</html:code> do not exist in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>."</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002038</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004895</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/>
        <html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_require_authentication" complexity="low" disruption="low" reboot="false" strategy="restrict">
for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+NOPASSWD[\s]*\:.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "NOPASSWD" matches to preserve user data
      sed -i "s|^${entry}$|# &amp;|g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done

for f in /etc/sudoers /etc/sudoers.d/* ; do
  if [ ! -e "$f" ] ; then
    continue
  fi
  matching_list=$(grep -P '^(?!#).*[\s]+\!authenticate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      # comment out "!authenticate" matches to preserve user data
      sed -i "s|^${entry}$|# &amp;|g" $f
    done &lt;&lt;&lt; "$matching_list"

    /usr/sbin/visudo -cf $f &amp;&gt; /dev/null || echo "Fail to validate $f with visudo"
  fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_require_authentication" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Find /etc/sudoers.d/ files
  ansible.builtin.find:
    paths:
    - /etc/sudoers.d/
  register: sudoers
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_authentication

- name: Remove lines containing NOPASSWD from sudoers files
  ansible.builtin.replace:
    regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
  - path: /etc/sudoers
  - '{{ sudoers.files }}'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_authentication

- name: Find /etc/sudoers.d/ files
  ansible.builtin.find:
    paths:
    - /etc/sudoers.d/
  register: sudoers
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_authentication

- name: Remove lines containing !authenticate from sudoers files
  ansible.builtin.replace:
    regexp: (^(?!#).*[\s]+\!authenticate.*$)
    replace: '# \g&lt;1&gt;'
    path: '{{ item.path }}'
    validate: /usr/sbin/visudo -cf %s
  with_items:
  - path: /etc/sudoers
  - '{{ sudoers.files }}'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_authentication
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_require_authentication:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" severity="medium">
              <xccdf-1.2:title>Require Re-Authentication When Using the sudo Command</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>timestamp_timeout</html:code> tag sets the amount of time sudo password prompt waits.
The default <html:code>timestamp_timeout</html:code> value is 5 minutes.
The timestamp_timeout should be configured by making sure that the
<html:code>timestamp_timeout</html:code> tag exists in
<html:code>/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code>/etc/sudoers.d/</html:code>.
If the value is set to an integer less than 0, the user's time stamp will not expire
and the user will not have to re-authenticate for privileged actions until the user's session is terminated.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004895</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002360</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271722r1091878_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/>
        <html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudo_require_reauthentication" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then

var_sudo_timestamp_timeout='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" use="legacy"/>'


if grep -Px '^[\s]*Defaults.*timestamp_timeout[\s]*=.*' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -Ei "/^[[:blank:]]*Defaults.*timestamp_timeout[[:blank:]]*=.*/d" {} \;
fi

if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*timestamp_timeout[\s]*=[\s]*[-]?\w+.*$' /etc/sudoers; then
        # sudoers file doesn't define Option timestamp_timeout
        echo "Defaults timestamp_timeout=${var_sudo_timestamp_timeout}" &gt;&gt; /etc/sudoers
    else
        # sudoers file defines Option timestamp_timeout, remediate wrong values if present
        if grep -qP "^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!${var_sudo_timestamp_timeout}\b)[-]?\w+\b.*$" /etc/sudoers; then
            sed -Ei "s/(^[[:blank:]]*Defaults.*timestamp_timeout[[:blank:]]*=)[[:blank:]]*[-]?\w+(.*$)/\1${var_sudo_timestamp_timeout}\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudo_require_reauthentication" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002360
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication
- name: XCCDF Value var_sudo_timestamp_timeout # promote to variable
  set_fact:
    var_sudo_timestamp_timeout: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" use="legacy"/>
  tags:
    - always

- name: Require Re-Authentication When Using the sudo Command - Find /etc/sudoers.d/*
    files containing 'Defaults timestamp_timeout'
  ansible.builtin.find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
  register: sudoers_d_defaults_timestamp_timeout
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002360
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Remove 'Defaults timestamp_timeout'
    from /etc/sudoers.d/* files
  ansible.builtin.lineinfile:
    path: '{{ item.path }}'
    regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
    state: absent
  with_items: '{{ sudoers_d_defaults_timestamp_timeout.files }}'
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002360
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Ensure timestamp_timeout
    has the appropriate value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\btimestamp_timeout[\s]*=[\s]*[-]?\w+\b(.*)$
    line: Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_timestamp_timeout_option
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002360
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Enable timestamp_timeout
    option with correct value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    line: Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}
    validate: /usr/sbin/visudo -cf %s
  when:
  - '"sudo" in ansible_facts.packages'
  - |
    edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed
  tags:
  - DISA-STIG-OL09-00-002360
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Remove timestamp_timeout
    wrong values in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!{{ var_sudo_timestamp_timeout
      }}\b)[-]?\w+\b.*$
    state: absent
    validate: /usr/sbin/visudo -cf %s
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002360
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_require_reauthentication:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_require_reauthentication_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_restrict_privilege_elevation_to_authorized" severity="medium">
              <xccdf-1.2:title>The operating system must restrict privilege elevation to authorized personnel</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo command allows a user to execute programs with elevated
(administrator) privileges. It prompts the user for their password
and confirms your request to execute a command by checking a file,
called sudoers.
Restrict privileged actions by removing the following entries from the sudoers file:
<html:code>ALL ALL=(ALL) ALL</html:code>
        <html:code>ALL ALL=(ALL:ALL) ALL</html:code>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as the exact requirement allows exceptions,
and removing lines from the sudoers file can make the system non-administrable.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000232</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271476r1091140_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the "sudoers" file is not configured correctly, any user defined
on the system can initiate privileged actions on the target system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_restrict_privilege_elevation_to_authorized:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_restrict_privilege_elevation_to_authorized_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudo_vdsm_nopasswd" severity="medium">
              <xccdf-1.2:title>Only the VDSM User Can Use sudo NOPASSWD</xccdf-1.2:title>
              <xccdf-1.2:description>The sudo <html:code>NOPASSWD</html:code> tag, when specified, allows a user to execute commands using sudo without having to authenticate. Only the <html:code>vdsm</html:code> user should have this capability in any sudo configuration snippets in <html:code>/etc/sudoers.d/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br/>
        <html:br/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudo_vdsm_nopasswd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_explicit_command_args" severity="medium">
              <xccdf-1.2:title>Explicit arguments in sudo specifications</xccdf-1.2:title>
              <xccdf-1.2:description>All commands in the sudoers file must strictly specify the arguments allowed to be used for a given user.
If the command is supposed to be executed only without arguments, pass "" as an argument in the corresponding user specification.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as absence of arguments in the user spec doesn't mean that the command is intended to be executed with no arguments.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">The rule can produce false findings when an argument contains a comma - sudoers syntax allows comma escaping using backslash, but the check doesn't support that. For example, <html:code>root ALL=(ALL) echo 1\,2</html:code> allows root to execute <html:code>echo 1,2</html:code>, but the check would interpret it as two commands <html:code>echo 1\</html:code> and <html:code>2</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R43</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Any argument can modify quite significantly the behavior of a program, whether regarding the
realized operation (read, write, delete, etc.) or accessed resources (path in a file system tree). To
avoid any possibility of misuse of a command by a user, the ambiguities must be removed at the
level of its specification.

For example, on some systems, the kernel messages are only accessible by root.
If a user nevertheless must have the privileges to read them, the argument of the dmesg command has to be restricted
in order to prevent the user from flushing the buffer through the -c option:
<html:pre>
user ALL = dmesg ""
</html:pre>
       </xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudoers_explicit_command_args:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudoers_explicit_command_args_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_no_command_negation" severity="medium">
              <xccdf-1.2:title>Don't define allowed commands in sudoers by means of exclusion</xccdf-1.2:title>
              <xccdf-1.2:description>Policies applied by sudo through the sudoers file should not involve negation.

Each user specification in the <html:code>sudoers</html:code> file contains a comma-delimited list of command specifications.
The definition can make use glob patterns, as well as of negations.
Indirect definition of those commands by means of exclusion of a set of commands is trivial to bypass, so it is not allowed to use such constructs.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as negations indicate design issues with the sudoers user specifications design. Just removing negations doesn't increase the security - you typically have to rethink the definition of allowed commands to fix the issue.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R42</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Specifying access right using negation is inefficient and can be easily circumvented.
For example, it is expected that a specification like <html:pre>
# To avoid absolutely , this rule can be easily circumvented!
user ALL = ALL ,!/ bin/sh
</html:pre> prevents the execution of the shell
but that’s not the case: just copy the binary <html:code>/bin/sh</html:code> to a different name to make it executable
again through the rule keyword <html:code>ALL</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudoers_no_command_negation:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudoers_no_command_negation_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_no_root_target" severity="medium">
              <xccdf-1.2:title>Don't target root user in the sudoers file</xccdf-1.2:title>
              <xccdf-1.2:description>The targeted users of a user specification should be, as much as possible, non privileged users (i.e.: non-root).

User specifications have to explicitly list the runas spec (i.e. the list of target users that can be impersonated), and <html:code>ALL</html:code> or <html:code>root</html:code> should not be used.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as the exact requirement allows exceptions, and removing lines from the sudoers file can make the system non-administrable.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R40</xccdf-1.2:reference>
              <xccdf-1.2:rationale>It is common that the command to be executed does not require superuser rights (editing a file
whose the owner is not root, sending a signal to an unprivileged process,etc.). In order to limit
any attempt of privilege escalation through a command, it is better to apply normal user rights.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudoers_no_root_target:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudoers_no_root_target_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sudoers_validate_passwd" severity="medium">
              <xccdf-1.2:title>Ensure invoking users password for privilege escalation when using sudo</xccdf-1.2:title>
              <xccdf-1.2:description>The sudoers security policy requires that users authenticate themselves before they can use sudo.
When sudoers requires authentication, it validates the invoking user's credentials.
The expected output for:
<html:pre> sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)$' </html:pre>
        <html:pre> Defaults !targetpw
      Defaults !rootpw
      Defaults !runaspw </html:pre>
or if cvtsudoers not supported:
<html:pre> sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; </html:pre>
        <html:pre> /etc/sudoers:Defaults !targetpw
      /etc/sudoers:Defaults !rootpw
      /etc/sudoers:Defaults !runaspw </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000231</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271475r1091137_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt
the invoking user for the "root" user password.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_sudo"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sudoers_validate_passwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then

if grep -x '^Defaults targetpw$' /etc/sudoers; then
    sed -i "/Defaults targetpw/d" /etc/sudoers \;
fi
if grep -x '^Defaults targetpw$' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -i "/Defaults targetpw/d" {} \;
fi
if grep -x '^Defaults rootpw$' /etc/sudoers; then
    sed -i "/Defaults rootpw/d" /etc/sudoers \;
fi
if grep -x '^Defaults rootpw$' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -i "/Defaults rootpw/d" {} \;
fi
if grep -x '^Defaults runaspw$' /etc/sudoers; then
    sed -i "/Defaults runaspw/d" /etc/sudoers \;
fi
if grep -x '^Defaults runaspw$' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -i "/Defaults runaspw/d" {} \;
fi

if [ -e "/etc/sudoers" ] ; then
    
    LC_ALL=C sed -i "/Defaults !targetpw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"

cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !targetpw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
if [ -e "/etc/sudoers" ] ; then
    
    LC_ALL=C sed -i "/Defaults !rootpw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"

cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !rootpw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"
if [ -e "/etc/sudoers" ] ; then
    
    LC_ALL=C sed -i "/Defaults !runaspw/d" "/etc/sudoers"
else
    touch "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"

cp "/etc/sudoers" "/etc/sudoers.bak"
# Insert at the end of the file
printf '%s\n' "Defaults !runaspw" &gt;&gt; "/etc/sudoers"
# Clean up after ourselves.
rm "/etc/sudoers.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sudoers_validate_passwd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Find out if /etc/sudoers.d/* files contain Defaults targetpw to be deduplicated
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^Defaults targetpw$
  register: sudoers_d_defaults
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Remove found occurrences of Defaults targetpw from /etc/sudoers.d/* files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^Defaults targetpw$
    state: absent
  with_items: '{{ sudoers_d_defaults.files }}'
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Find out if /etc/sudoers.d/* files contain Defaults rootpw to be deduplicated
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^Defaults rootpw$
  register: sudoers_d_defaults
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Remove found occurrences of Defaults rootpw from /etc/sudoers.d/* files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^Defaults rootpw$
    state: absent
  with_items: '{{ sudoers_d_defaults.files }}'
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Find out if /etc/sudoers.d/* files contain Defaults runaspw to be deduplicated
  find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^Defaults runaspw$
  register: sudoers_d_defaults
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Remove found occurrences of Defaults runaspw from /etc/sudoers.d/* files
  lineinfile:
    path: '{{ item.path }}'
    regexp: ^Defaults runaspw$
    state: absent
  with_items: '{{ sudoers_d_defaults.files }}'
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Remove any ocurrences of Defaults targetpw in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^Defaults targetpw$
    validate: /usr/sbin/visudo -cf %s
    state: absent
  register: sudoers_file_defaults
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Remove any ocurrences of Defaults rootpw in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^Defaults rootpw$
    validate: /usr/sbin/visudo -cf %s
    state: absent
  register: sudoers_file_defaults
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Remove any ocurrences of Defaults runaspw in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^Defaults runaspw$
    validate: /usr/sbin/visudo -cf %s
    state: absent
  register: sudoers_file_defaults
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !targetpw$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !targetpw$
    state: absent
  when:
  - '"sudo" in ansible_facts.packages'
  - dupes.found is defined and dupes.found &gt; 1
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !targetpw$
    line: Defaults !targetpw
    state: present
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !rootpw$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !rootpw$
    state: absent
  when:
  - '"sudo" in ansible_facts.packages'
  - dupes.found is defined and dupes.found &gt; 1
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !rootpw$
    line: Defaults !rootpw
    state: present
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Check for duplicate values
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !runaspw$
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Deduplicate values from /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !runaspw$
    state: absent
  when:
  - '"sudo" in ansible_facts.packages'
  - dupes.found is defined and dupes.found &gt; 1
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd

- name: Insert correct line into /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    create: false
    regexp: ^Defaults !runaspw$
    line: Defaults !runaspw
    state: present
  when: '"sudo" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000231
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudoers_validate_passwd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sudoers_validate_passwd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sudoers_validate_passwd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_system-tools">
            <xccdf-1.2:title>System Tooling / Utilities</xccdf-1.2:title>
            <xccdf-1.2:description>The following checks evaluate the system for recommended base packages -- both for installation
and removal.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_cryptsetup-luks_installed" severity="medium">
              <xccdf-1.2:title>Install cryptsetup Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>cryptsetup</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install cryptsetup</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.25.SEC-OL1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>LUKS is the upcoming standard for Linux hard disk encryption. By providing a standard
on-disk format, it does not only facilitate compatibility among distributions, but also
provide secure management of multiple user passwords. In contrast to existing solution,
LUKS stores all necessary setup information in the partition header, enabling the user
to transport or migrate their data seamlessly. LUKS for dm-crypt is implemented in
<html:code>cryptsetup</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "cryptsetup" ; then
    yum install -y "cryptsetup"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure cryptsetup is installed
  package:
    name: cryptsetup
    state: present
  tags:
  - PCI-DSSv4-3.5
  - PCI-DSSv4-3.5.1
  - PCI-DSSv4-3.5.1.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_cryptsetup-luks_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_cryptsetup

class install_cryptsetup {
  package { 'cryptsetup':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_cryptsetup-luks_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=cryptsetup
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_cryptsetup-luks_installed">
[[packages]]
name = "cryptsetup"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_cryptsetup-luks_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed" severity="medium">
              <xccdf-1.2:title>Ensure gnutls-utils is installed</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>gnutls-utils</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install gnutls-utils</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_X509_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_X509_EXT.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_X509_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271518r1091266_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>GnuTLS is a secure communications library implementing the SSL, TLS and DTLS
protocols and technologies around them. It provides a simple C language
application programming interface (API) to access the secure communications
protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and
other required structures.
This package contains command line TLS client and server and certificate
manipulation tools.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "gnutls-utils" ; then
    yum install -y "gnutls-utils"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure gnutls-utils is installed
  package:
    name: gnutls-utils
    state: present
  tags:
  - DISA-STIG-OL09-00-000430
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_gnutls-utils_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_gnutls-utils

class install_gnutls-utils {
  package { 'gnutls-utils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_gnutls-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=gnutls-utils
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_gnutls-utils_installed">
[[packages]]
name = "gnutls-utils"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_gnutls-utils_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_gnutls-utils_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nss-tools_installed" severity="medium">
              <xccdf-1.2:title>Ensure nss-tools is installed</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nss-tools</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install nss-tools</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000380</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271513r1091251_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Network Security Services (NSS) is a set of libraries designed to
support cross-platform development of security-enabled client and
server applications. Install the <html:code>nss-tools</html:code> package
to install command-line tools to manipulate the NSS certificate
and key database.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "nss-tools" ; then
    yum install -y "nss-tools"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure nss-tools is installed
  package:
    name: nss-tools
    state: present
  tags:
  - DISA-STIG-OL09-00-000380
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_nss-tools_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_nss-tools

class install_nss-tools {
  package { 'nss-tools':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nss-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=nss-tools
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_nss-tools_installed">
[[packages]]
name = "nss-tools"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_nss-tools_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_nss-tools_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed" severity="medium">
              <xccdf-1.2:title>Install openscap-scanner Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>openscap-scanner</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install openscap-scanner</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">AGD_PRE.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">AGD_OPE.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>openscap-scanner</html:code> contains the <html:code>oscap</html:code> command line tool. This tool is a
configuration and vulnerability scanner, capable of performing compliance checking using
SCAP content.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "openscap-scanner" ; then
    yum install -y "openscap-scanner"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure openscap-scanner is installed
  package:
    name: openscap-scanner
    state: present
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openscap-scanner_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openscap-scanner

class install_openscap-scanner {
  package { 'openscap-scanner':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openscap-scanner_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openscap-scanner
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_openscap-scanner_installed">
[[packages]]
name = "openscap-scanner"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_openscap-scanner_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rear_installed" severity="medium">
              <xccdf-1.2:title>Install rear Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rear</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install rear</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale><html:code>rear</html:code> contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable
image of a system and restores from backup using this image.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch_and_os_linux_ol_gt_or_eq_9_0_or_aarch64_arch_and_os_linux_rhel_gt_or_eq_9_0_or_os_linux_rhel_le_or_eq_8_4_and_s390x_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ! ( ( ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) &amp;&amp; grep -qP "^ID=[\"']?ol[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="9.0"; printf "%s\n%s" "$expected" "$real" | sort -VC; } ) || ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) &amp;&amp; grep -qP "^ID=[\"']?rhel[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="9.0"; printf "%s\n%s" "$expected" "$real" | sort -VC; } ) || ( grep -qP "^ID=[\"']?rhel[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="8.4"; printf "%s\n%s" "$real" "$expected" | sort -VC; } &amp;&amp; ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) ) ) ); then

if ! rpm -q --quiet "rear" ; then
    yum install -y "rear"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure rear is installed
  package:
    name: rear
    state: present
  when: not ( ( ( ansible_architecture == "aarch64" and ansible_distribution == 'OracleLinux'
    and ansible_distribution_version is version('9.0', '&gt;=') ) or ( ansible_architecture
    == "aarch64" and ansible_distribution == 'RedHat' and ansible_distribution_version
    is version('9.0', '&gt;=') ) or ( ansible_distribution == 'RedHat' and ansible_distribution_version
    is version('8.4', '&lt;=') and ansible_architecture == "s390x" ) ) )
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rear_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rear

class install_rear {
  package { 'rear':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rear_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rear
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rear_installed">
[[packages]]
name = "rear"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_rear_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_rear_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" severity="low">
              <xccdf-1.2:title>Install rng-tools Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rng-tools</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install rng-tools</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000370</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271512r1091248_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>rng-tools</html:code> provides hardware random number generator tools,
such as those used in the formation of x509/PKI certificates.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_runtime_kernel_fips_enabled_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ( ! ( [ "$(sysctl -a | grep -c 'fips_enabled.*1')" -eq 1 ] ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if ! rpm -q --quiet "rng-tools" ; then
    yum install -y "rng-tools"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000370
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_rng-tools_installed

- name: Ensure rng-tools is installed
  package:
    name: rng-tools
    state: present
  when: ( ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
    )
  tags:
  - DISA-STIG-OL09-00-000370
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_rng-tools_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rng-tools

class install_rng-tools {
  package { 'rng-tools':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rng-tools_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rng-tools
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rng-tools_installed">
[[packages]]
name = "rng-tools"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_rng-tools_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed" severity="medium">
              <xccdf-1.2:title>Install scap-security-guide Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>scap-security-guide</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install scap-security-guide</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">AGD_PRE.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">AGD_OPE.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>scap-security-guide</html:code> package provides a guide for configuration of the system
from the final system's security point of view. The guidance is specified in the Security
Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening
advice, linked to government requirements where applicable. The SCAP Security Guide project
bridges the gap between generalized policy requirements and specific implementation guidelines.
A system administrator can use the <html:code>oscap</html:code> CLI tool from the <html:code>openscap-scanner</html:code>
package, or the SCAP Workbench GUI tool from the <html:code>scap-workbench</html:code> package, to verify
that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
page for futher information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "scap-security-guide" ; then
    yum install -y "scap-security-guide"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure scap-security-guide is installed
  package:
    name: scap-security-guide
    state: present
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_scap-security-guide_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_scap-security-guide

class install_scap-security-guide {
  package { 'scap-security-guide':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_scap-security-guide_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=scap-security-guide
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_scap-security-guide_installed">
[[packages]]
name = "scap-security-guide"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_scap-security-guide_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" severity="medium">
              <xccdf-1.2:title>Uninstall gssproxy Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>gssproxy</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase gssproxy</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000115</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271459r1091089_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>gssproxy</html:code> is a proxy for GSS API credential handling.
Kerberos relies on some key derivation functions that may not
be compatible with some site policies such as FIPS 140.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_gssproxy_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove gssproxy
#	   from the system, and may remove any packages
#	   that depend on gssproxy. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "gssproxy" ; then
yum remove -y "gssproxy"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_gssproxy_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure gssproxy is removed
  package:
    name: gssproxy
    state: absent
  tags:
  - DISA-STIG-OL09-00-000115
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_gssproxy_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_gssproxy_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_gssproxy

class remove_gssproxy {
  package { 'gssproxy':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_gssproxy_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_iprutils_removed" severity="medium">
              <xccdf-1.2:title>Uninstall iprutils Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>iprutils</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase iprutils</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271460r1091092_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>iprutils</html:code> provides a suite of utlilities to manage and configure SCSI devices
supported by the ipr SCSI storage device driver.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove iprutils
#	   from the system, and may remove any packages
#	   that depend on iprutils. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "iprutils" ; then
yum remove -y "iprutils"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure iprutils is removed
  package:
    name: iprutils
    state: absent
  tags:
  - DISA-STIG-OL09-00-000120
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_iprutils_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_iprutils

class remove_iprutils {
  package { 'iprutils':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_iprutils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=iprutils
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_iprutils_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_tuned_removed" severity="medium">
              <xccdf-1.2:title>Uninstall tuned Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>tuned</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase tuned</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271461r1091095_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>tuned</html:code> contains a daemon that tunes the system settings dynamically.
It does so by monitoring the usage of several system components periodically. Based
on that information, components will then be put into lower or higher power savings
modes to adapt to the current usage.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove tuned
#	   from the system, and may remove any packages
#	   that depend on tuned. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "tuned" ; then
yum remove -y "tuned"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure tuned is removed
  package:
    name: tuned
    state: absent
  tags:
  - DISA-STIG-OL09-00-000125
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_tuned_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_tuned

class remove_tuned {
  package { 'tuned':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_tuned_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=tuned
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_tuned_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_tuned_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_updating">
            <xccdf-1.2:title>Updating Software</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>yum</html:code> command line tool is used to install and
update software packages. The system also provides a graphical
software update tool in the <html:b>System</html:b> menu, in the <html:b>Administration</html:b> submenu,
called <html:b>Software Update</html:b>.
<html:br/>
       <html:br/>
Oracle Linux 9 systems contain an installed software catalog called
the RPM database, which records metadata of installed packages. Consistently using
<html:code>yum</html:code> or the graphical <html:b>Software Update</html:b> for all software installation
allows for insight into the current inventory of installed software on the system.
<html:br/>
       <html:br/>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" severity="medium">
              <xccdf-1.2:title>Install dnf-automatic Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>dnf-automatic</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install dnf-automatic</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R61</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>dnf-automatic</html:code> is an alternative command line interface (CLI)
to <html:code>dnf upgrade</html:code> suitable for automatic, regular execution.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

if ! rpm -q --quiet "dnf-automatic" ; then
    yum install -y "dnf-automatic"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_dnf-automatic_installed

- name: Ensure dnf-automatic is installed
  package:
    name: dnf-automatic
    state: present
  when: not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_dnf-automatic_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_dnf-automatic

class install_dnf-automatic {
  package { 'dnf-automatic':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_dnf-automatic_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=dnf-automatic
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_dnf-automatic_installed">
[[packages]]
name = "dnf-automatic"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_dnf-automatic_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_dnf-automatic_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_clean_components_post_updating" severity="low">
              <xccdf-1.2:title>Ensure yum Removes Previous Package Versions</xccdf-1.2:title>
              <xccdf-1.2:description><html:code>yum</html:code> should be configured to remove previous software components after
new versions have been installed. To configure <html:code>yum</html:code> to remove the

previous software components after updating, set the <html:code>clean_requirements_on_remove</html:code>


to <html:code>1</html:code> in <html:code>/etc/yum.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002617</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000437-GPOS-00194</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000495</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271522r1091278_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Previous versions of software components that are not removed from the information
system after updates have been installed may be exploited by some adversaries.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_yum"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="clean_components_post_updating"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

if grep --silent ^clean_requirements_on_remove /etc/yum.conf ; then
        sed -i "s/^clean_requirements_on_remove.*/clean_requirements_on_remove=1/g" /etc/yum.conf
else
        echo -e "\n# Set clean_requirements_on_remove to 1 per security requirements" &gt;&gt; /etc/yum.conf
        echo "clean_requirements_on_remove=1" &gt;&gt; /etc/yum.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="clean_components_post_updating" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000495
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(6)
  - clean_components_post_updating
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure yum Removes Previous Package Versions - Ensure YUM Removes Previous
    Package Versions
  ansible.builtin.lineinfile:
    dest: /etc/yum.conf
    regexp: ^#?clean_requirements_on_remove
    line: clean_requirements_on_remove=1
    insertafter: \[main\]
    create: true
  when: '"yum" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000495
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(6)
  - clean_components_post_updating
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-clean_components_post_updating:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-clean_components_post_updating_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" severity="medium">
              <xccdf-1.2:title>Configure dnf-automatic to Install Available Updates Automatically</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure that the packages comprising the available updates will be automatically installed by <html:code>dnf-automatic</html:code>, set <html:code>apply_updates</html:code> to <html:code>yes</html:code> under <html:code>[commands]</html:code> section in <html:code>/etc/dnf/automatic.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0940</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1144</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1467</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1472</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1483</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1493</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1494</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1495</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000805-GPOS-00260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R61</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.
The automated installation of updates ensures that recent security patches
are applied in a timely manner.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dnf-automatic_apply_updates"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/dnf/automatic.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[commands\]([^\n\[]*\n+)+?[[:space:]]*apply_updates" "$f"; then

            sed -i "s/apply_updates[^(\n)]*/apply_updates=yes/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[commands\]" "$f"; then

            sed -i "/[[:space:]]*\[commands\]/a apply_updates=yes" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/dnf/automatic.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[commands]\napply_updates=yes" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dnf-automatic_apply_updates:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dnf-automatic_apply_updates_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" severity="low">
              <xccdf-1.2:title>Configure dnf-automatic to Install Only Security Updates</xccdf-1.2:title>
              <xccdf-1.2:description>To configure <html:code>dnf-automatic</html:code> to install only security updates
automatically, set <html:code>upgrade_type</html:code> to <html:code>security</html:code> under
<html:code>[commands]</html:code> section in <html:code>/etc/dnf/automatic.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R61</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By default, <html:code>dnf-automatic</html:code> installs all available updates.
Reducing the amount of updated packages only to updates that were
issued as a part of a security advisory increases the system stability.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dnf-automatic_security_updates_only"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/dnf/automatic.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[commands\]([^\n\[]*\n+)+?[[:space:]]*upgrade_type" "$f"; then

            sed -i "s/upgrade_type[^(\n)]*/upgrade_type=security/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[commands\]" "$f"; then

            sed -i "/[[:space:]]*\[commands\]/a upgrade_type=security" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/dnf/automatic.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[commands]\nupgrade_type=security" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dnf-automatic_security_updates_only:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dnf-automatic_security_updates_only_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled In Main yum Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>gpgcheck</html:code> option controls whether
RPM packages' signatures are always checked prior to installation.
To configure yum to check package signatures before installing
them, ensure the following line appears in <html:code>/etc/yum.conf</html:code> in
the <html:code>[main]</html:code> section:
<html:pre>gpgcheck=1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003992</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R59</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000497</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271524r1091284_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
<html:br/>
Accordingly, patches, service packs, device drivers, or operating system
components must be signed with a certificate recognized and approved by the
organization.
<html:br/>Verifying the authenticity of the software prior to installation
validates the integrity of the patch or upgrade received from a vendor.
This ensures the software has not been tampered with and that it has been
provided by a trusted vendor. Self-signed certificates are disallowed by
this requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA).</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_yum"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_gpgcheck_globally_activated"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^gpgcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^gpgcheck\\&gt;" "/etc/yum.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^gpgcheck\\&gt;.*/$escaped_formatted_output/gi" "/etc/yum.conf"
else
    if [[ -s "/etc/yum.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/yum.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/yum.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/yum.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_gpgcheck_globally_activated" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000497
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - configure_strategy
  - ensure_gpgcheck_globally_activated
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed

- name: Ensure GPG check is globally activated
  ini_file:
    dest: /etc/yum.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when: '"yum" in ansible_facts.packages'
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000497
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - configure_strategy
  - ensure_gpgcheck_globally_activated
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_gpgcheck_globally_activated:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled for Local Packages</xccdf-1.2:title>
              <xccdf-1.2:description><html:code>yum</html:code> should be configured to verify the signature(s) of local packages
prior to installation. To configure <html:code>yum</html:code> to verify signatures of local
packages, set the <html:code>localpkg_gpgcheck</html:code> to <html:code>1</html:code> in <html:code>/etc/yum.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003992</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R59</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000496</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271523r1091281_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to any software components can have significant effects to the overall security
of the operating system. This requirement ensures the software has not been tampered and
has been provided by a trusted vendor.
<html:br/>
        <html:br/>
Accordingly, patches, service packs, device drivers, or operating system components must
be signed with a certificate recognized and approved by the organization.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_yum"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_gpgcheck_local_packages"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^localpkg_gpgcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^localpkg_gpgcheck\\&gt;" "/etc/yum.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^localpkg_gpgcheck\\&gt;.*/$escaped_formatted_output/gi" "/etc/yum.conf"
else
    if [[ -s "/etc/yum.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/yum.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/yum.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/yum.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_gpgcheck_local_packages" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000496
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - ensure_gpgcheck_local_packages
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Ensure GPG check Enabled for Local Packages (yum)
  block:

  - name: Check stats of yum
    stat:
      path: /etc/yum.conf
    register: pkg

  - name: Check if config file of yum is a symlink
    ansible.builtin.set_fact:
      pkg_config_file_symlink: '{{ pkg.stat.lnk_target if pkg.stat.lnk_target is match("^/.*")
        else "/etc/yum.conf" | dirname ~ "/" ~ pkg.stat.lnk_target }}'
    when: pkg.stat.lnk_target is defined

  - name: Ensure GPG check Enabled for Local Packages (yum)
    ini_file:
      dest: '{{ pkg_config_file_symlink |  default("/etc/yum.conf") }}'
      section: main
      option: localpkg_gpgcheck
      value: 1
      no_extra_spaces: true
      create: true
  when: '"yum" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000496
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - ensure_gpgcheck_local_packages
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_gpgcheck_local_packages:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" severity="high">
              <xccdf-1.2:title>Ensure gpgcheck Enabled for All yum Package Repositories</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure signature checking is not disabled for
any repos, remove any lines from files in <html:code>/etc/yum.repos.d</html:code> of the form:
<html:pre>gpgcheck=0</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003992</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R59</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000498</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271525r1091287_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Verifying the authenticity of the software prior to installation validates
the integrity of the patch or upgrade received from a vendor. This ensures
the software has not been tampered with and that it has been provided by a
trusted vendor. Self-signed certificates are disallowed by this
requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA)."</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_gpgcheck_never_disabled">
sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_gpgcheck_never_disabled" complexity="low" disruption="medium" reboot="false" strategy="enable">- name: Grep for yum repo section names
  shell: |
    set -o pipefail
    grep -HEr '^\[.+\]' -r /etc/yum.repos.d/
  register: repo_grep_results
  failed_when: repo_grep_results.rc not in [0, 1]
  changed_when: false
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000498
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - enable_strategy
  - ensure_gpgcheck_never_disabled
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed

- name: Set gpgcheck=1 for each yum repo
  ini_file:
    path: '{{ item[0] }}'
    section: '{{ item[1] }}'
    option: gpgcheck
    value: '1'
    no_extra_spaces: true
  loop: '{{ repo_grep_results.stdout |regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
    if repo_grep_results is not skipped else [] }}'
  when: repo_grep_results is not skipped
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000498
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - enable_strategy
  - ensure_gpgcheck_never_disabled
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_gpgcheck_never_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_oracle_gpgkey_installed" severity="high">
              <xccdf-1.2:title>Ensure Oracle Linux GPG Key Installed</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure the system can cryptographically verify base software
packages come from Oracle (and to connect to the Unbreakable Linux Network to
receive them), the Oracle GPG key must properly be installed.
To install the Oracle GPG key, run:
<html:pre>$ sudo uln_register</html:pre>
If the system is not connected to the Internet,
then install the Oracle GPG key from trusted media such as
the Oracle installation CD-ROM or DVD. Assuming the disc is mounted
in <html:code>/media/cdrom</html:code>, use the following command as the root user to import
it into the keyring:
<html:pre>$ sudo rpm --import /media/cdrom/RPM-GPG-KEY-oracle</html:pre>

Alternatively, the key may be pre-loaded during the Oracle installation. In
such cases, the key can be installed by running the following command:
<html:pre>sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R59</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000499</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271526r1092460_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Changes to software components can have significant effects on the
overall security of the operating system. This requirement ensures
the software has not been tampered with and that it has been provided
by a trusted vendor. The Oracle GPG key is necessary to
cryptographically verify packages are from Oracle.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_oracle_gpgkey_installed"># OL fingerprints below retrieved from: https://linux.oracle.com/security/gpg/#gpg
readonly OL_RELEASE_FINGERPRINT="3E6D826D3FBAB389C2F38E34BC4D06A08D8B756F"
readonly OL_AUXILIARY_FINGERPRINT="982231759C7467065D0CE9B2A7DD07088B4EFBE6"

FINGERPRINTS_REGEX="${OL_RELEASE_FINGERPRINT}"

if [[ -n "$OL_AUXILIARY_FINGERPRINT" ]]; then
    FINGERPRINTS_REGEX+="|${OL_AUXILIARY_FINGERPRINT}"
fi

# Location of the key we would like to import (once it's integrity verified)
readonly OL_RELEASE_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-oracle"

RPM_GPG_DIR_PERMS=$(stat -c %a "$(dirname "$OL_RELEASE_KEY")")

# Verify /etc/pki/rpm-gpg directory permissions are safe
if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]
then
  # If they are safe, try to obtain fingerprints from the key file
  # (to ensure there won't be e.g. CRC error)
  
    readarray -t GPG_OUT &lt; &lt;(gpg --show-keys --with-fingerprint --with-colons "$OL_RELEASE_KEY" | grep -A1 "^pub" | grep "^fpr" | cut -d ":" -f 10)
  

  GPG_RESULT=$?
  # No CRC error, safe to proceed
  if [ "${GPG_RESULT}" -eq "0" ]
  then
    # Filter just hexadecimal fingerprints from gpg's output from
    # processing of a key file
    echo "${GPG_OUT[*]}" | grep -vE "$FINGERPRINTS_REGEX" || {
      # If $ OL_RELEASE_KEY file doesn't contain any keys with unknown fingerprint, import it
      rpm --import "${OL_RELEASE_KEY}"
    }
  fi
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_oracle_gpgkey_installed" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Ensure Oracle Linux GPG Key Installed - Read GPG key directory permission
  ansible.builtin.stat:
    path: /etc/pki/rpm-gpg/
  register: gpg_key_directory_permission
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-000499
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - ensure_oracle_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Ensure Oracle Linux GPG Key Installed - Retrieve GPG key fingerprints information
  ansible.builtin.command: gpg --show-keys --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-oracle"
  changed_when: false
  register: gpg_fingerprints
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-000499
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - ensure_oracle_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Ensure Oracle Linux GPG Key Installed - Set fact for installed fingerprints
  ansible.builtin.set_fact:
    gpg_installed_fingerprints: |-
      {{ gpg_fingerprints.stdout | regex_findall('^pub.*
      (?:^fpr[:]*)([0-9A-Fa-f]*)', '\1') | list }}
  tags:
  - DISA-STIG-OL09-00-000499
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - ensure_oracle_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Ensure Oracle Linux GPG Key Installed - Set fact for valid fingerprints
  ansible.builtin.set_fact:
    gpg_valid_fingerprints:
    - 3E6D826D3FBAB389C2F38E34BC4D06A08D8B756F
    - 982231759C7467065D0CE9B2A7DD07088B4EFBE6
  tags:
  - DISA-STIG-OL09-00-000499
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - ensure_oracle_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Ensure Oracle Linux GPG Key Installed - Import Oracle GPG key securely
  ansible.builtin.rpm_key:
    state: present
    key: /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
  when:
  - gpg_key_directory_permission.stat.mode &lt;= '0755'
  - (gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length ==
    0
  - gpg_installed_fingerprints | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-000499
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - ensure_oracle_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_oracle_gpgkey_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_oracle_gpgkey_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" severity="medium">
              <xccdf-1.2:title>Ensure Software Patches Installed</xccdf-1.2:title>
              <xccdf-1.2:description>
If the system is joined to the ULN
or a yum server, run the following command to install updates:
<html:pre>$ sudo yum update</html:pre>
If the system is not configured to use one of these sources, updates (in the form of RPM packages)
can be manually downloaded from the ULN and installed using <html:code>rpm</html:code>.

<html:br/>
        <html:br/>
NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy
dictates.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The OVAL feed of Oracle Linux 9 is not a XML file, which may not be understood by all scanners.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R61</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271439r1091029_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="security_patches_up_to_date" complexity="low" disruption="high" reboot="true" strategy="patch">

yum -y update
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="security_patches_up_to_date" complexity="low" disruption="high" reboot="true" strategy="patch">- name: Security patches are up to date
  package:
    name: '*'
    state: latest
  tags:
  - CJIS-5.10.4.1
  - DISA-STIG-OL09-00-000015
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(5)
  - NIST-800-53-SI-2(c)
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - high_disruption
  - low_complexity
  - medium_severity
  - patch_strategy
  - reboot_required
  - security_patches_up_to_date
  - skip_ansible_lint
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" multi-check="true">
                <xccdf-1.2:check-content-ref href="security-oval-com.oracle.elsa-ol9.xml.bz2"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" severity="medium">
              <xccdf-1.2:title>Enable dnf-automatic Timer</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>dnf-automatic</html:code> timer can be enabled with the following command:
<html:pre>$ sudo systemctl enable dnf-automatic.timer</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000191-GPOS-00080</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R61</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>dnf-automatic</html:code> is an alternative command line interface (CLI) to <html:code>dnf upgrade</html:code> with specific facilities to make it suitable to be executed automatically and regularly from systemd timers, cron jobs and similar.
The tool is controlled by <html:code>dnf-automatic.timer</html:code> SystemD timer.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="timer_dnf-automatic_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'dnf-automatic.timer'
fi
"$SYSTEMCTL_EXEC" enable 'dnf-automatic.timer'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="timer_dnf-automatic_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(5)
  - NIST-800-53-SI-2(c)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - timer_dnf-automatic_enabled

- name: Enable timer dnf-automatic
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable timer dnf-automatic
    systemd:
      name: dnf-automatic.timer
      enabled: 'yes'
      state: started
    when:
    - '"dnf-automatic" in ansible_facts.packages'
  when: not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-2(5)
  - NIST-800-53-SI-2(c)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - timer_dnf-automatic_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-timer_dnf-automatic_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-timer_dnf-automatic_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts">
          <xccdf-1.2:title>Account and Access Control</xccdf-1.2:title>
          <xccdf-1.2:description>In traditional Unix security, if an attacker gains
shell access to a certain login account, they can perform any action
or access any file to which that account has access. Therefore,
making it more difficult for unauthorized people to gain shell
access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
Oracle Linux 9.</xccdf-1.2:description>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authselect_profile" type="string">
            <xccdf-1.2:title>Authselect profile</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the authselect profile to select</xccdf-1.2:description>
            <xccdf-1.2:value>minimal</xccdf-1.2:value>
            <xccdf-1.2:value selector="minimal">minimal</xccdf-1.2:value>
            <xccdf-1.2:value selector="sssd">sssd</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_enable_authselect" severity="medium">
            <xccdf-1.2:title>Enable authselect</xccdf-1.2:title>
            <xccdf-1.2:description>Configure user authentication setup to use the <html:code>authselect</html:code> tool.
If authselect profile is selected, the rule will enable the <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authselect_profile" use="legacy"/> profile.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">If the <html:code>sudo authselect select</html:code> command returns an error informing that the chosen
profile cannot be selected, it is probably because PAM files have already been modified by
the administrator. If this is the case, in order to not overwrite the desired changes made
by the administrator, the current PAM settings should be investigated before forcing the
selection of the chosen authselect profile.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">enable_authselect</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">needed_rules</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Authselect is a successor to authconfig.
It is a tool to select system authentication and identity sources from a list of supported
profiles instead of letting the administrator manually build the PAM stack.

That way, it avoids potential breakage of configuration, as it ships several tested profiles
that are well tested and supported to solve different use-cases.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="enable_authselect">
var_authselect_profile='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authselect_profile" use="legacy"/>'


authselect current

if test "$?" -ne 0; then
    authselect select "$var_authselect_profile"

    if test "$?" -ne 0; then
        if rpm --quiet --verify pam; then
            authselect select --force "$var_authselect_profile"
        else
	        echo "authselect is not used but files from the 'pam' package have been altered, so the authselect configuration won't be forced." &gt;&amp;2
        fi
    fi
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="enable_authselect" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: XCCDF Value var_authselect_profile # promote to variable
  set_fact:
    var_authselect_profile: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authselect_profile" use="legacy"/>
  tags:
    - always

- name: Enable authselect - Check Current authselect Profile
  ansible.builtin.command:
    cmd: authselect current
  register: result_authselect_current
  changed_when: false
  failed_when: false
  tags:
  - DISA-STIG-needed_rules
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Try to Select an authselect Profile
  ansible.builtin.command:
    cmd: authselect select "{{ var_authselect_profile }}"
  register: result_authselect_select
  changed_when: result_authselect_select.rc == 0
  failed_when: false
  when: result_authselect_current.rc != 0
  tags:
  - DISA-STIG-needed_rules
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Verify If pam Has Been Altered
  ansible.builtin.command:
    cmd: rpm -qV pam
  register: result_altered_authselect
  changed_when: false
  failed_when: false
  when:
  - result_authselect_select is not skipped
  - result_authselect_select.rc != 0
  tags:
  - DISA-STIG-needed_rules
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Informative Message Based on authselect Integrity Check
  ansible.builtin.assert:
    that:
    - result_authselect_current.rc == 0 or result_altered_authselect is skipped or
      result_altered_authselect.rc == 0
    fail_msg:
    - authselect is not used but files from the 'pam' package have been altered, so
      the authselect configuration won't be forced.
  tags:
  - DISA-STIG-needed_rules
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Force authselect Profile Selection
  ansible.builtin.command:
    cmd: authselect select --force "{{ var_authselect_profile }}"
  when:
  - result_authselect_current.rc != 0
  - result_authselect_select.rc != 0
  - result_altered_authselect.rc == 0
  tags:
  - DISA-STIG-needed_rules
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-enable_authselect:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-enable_authselect_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-banners">
            <xccdf-1.2:title>Warning Banners for System Accesses</xccdf-1.2:title>
            <xccdf-1.2:description>Each system should expose as little information about
itself as possible.
<html:br/>
       <html:br/>
System banners, which are typically displayed just before a
login prompt, give out information about the service or the host's
operating system. This might include the distribution name and the
system kernel version, and the particular version of a network
service. This information can assist intruders in gaining access to
the system as it can reveal whether the system is running
vulnerable software. Most network services can be configured to
limit what information is displayed.
<html:br/>
       <html:br/>
Many organizations implement security policies that require a
system banner provide notice of the system's ownership, provide
warning to unauthorized users, and remind authorized users of their
consent to monitoring.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_login_banner_text" type="string">
              <xccdf-1.2:title>Login Banner Verbiage</xccdf-1.2:title>
              <xccdf-1.2:description>Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
              <xccdf-1.2:value selector="cis_banners">^(Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="cis_default">^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication,[\s\n]+transmission,[\s\n]+processing,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
              <xccdf-1.2:value>^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_motd_banner_text" type="string">
              <xccdf-1.2:title>MotD Banner Verbiage</xccdf-1.2:title>
              <xccdf-1.2:description>Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
              <xccdf-1.2:value selector="cis_banners">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="cis_default">^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication,[\s\n]+transmission,[\s\n]+processing,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
              <xccdf-1.2:value>^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_remote_login_banner_text" type="string">
              <xccdf-1.2:title>Remote Login Banner Verbiage</xccdf-1.2:title>
              <xccdf-1.2:description>Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
              <xccdf-1.2:value selector="cis_banners">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="cis_default">^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication,[\s\n]+transmission,[\s\n]+processing,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
              <xccdf-1.2:value>^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_banner_etc_issue" severity="medium">
              <xccdf-1.2:title>Modify the System Login Banner</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system login banner edit <html:code>/etc/issue</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.


The DoD required text is either:
<html:br/>
        <html:br/>
        <html:code>You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
        <html:br/>
        <html:br/>
OR:
<html:br/>
        <html:br/>
        <html:code>I've read &amp; consent to terms in IS user agreem't.</html:code>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271455r1091077_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br/>
        <html:br/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="banner_etc_issue"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)
cat &lt;&lt;EOF &gt;/etc/issue
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="banner_etc_issue" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000090
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - banner_etc_issue
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Login Banner - Ensure Correct Banner
  copy:
    dest: /etc/issue
    content: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000090
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - banner_etc_issue
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-banner_etc_issue:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-banner_etc_issue_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_banner_etc_issue_net" severity="medium">
              <xccdf-1.2:title>Modify the System Login Banner for Remote Connections</xccdf-1.2:title>
              <xccdf-1.2:description>To configure the system login banner edit <html:code>/etc/issue.net</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br/>
        <html:br/>
        <html:code>You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
        <html:br/>
        <html:br/>
OR:
<html:br/>
        <html:br/>
        <html:code>I've read &amp; consent to terms in IS user agreem't.</html:code>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br/>
        <html:br/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="banner_etc_issue_net"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

remote_login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_remote_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/\\//g')
formatted=$(echo "$remote_login_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/issue.net
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="banner_etc_issue_net" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - banner_etc_issue_net
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value remote_login_banner_text # promote to variable
  set_fact:
    remote_login_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_remote_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Login Banner for Remote Connections - ensure correct banner
  copy:
    dest: /etc/issue.net
    content: '{{ remote_login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - banner_etc_issue_net
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-remote_login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_remote_login_banner_text"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-banner_etc_issue_net:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-banner_etc_issue_net_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_banner_etc_motd" severity="medium">
              <xccdf-1.2:title>Modify the System Message of the Day Banner</xccdf-1.2:title>
              <xccdf-1.2:description>To configure the system message banner edit <html:code>/etc/motd</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br/>
        <html:br/>
        <html:code>You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
        <html:br/>
        <html:br/>
OR:
<html:br/>
        <html:br/>
        <html:code>I've read &amp; consent to terms in IS user agreem't.</html:code>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br/>
        <html:br/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="banner_etc_motd"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

motd_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_motd_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
motd_banner_text=$(echo "$motd_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
motd_banner_text=$(echo "$motd_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
motd_banner_text=$(echo "$motd_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
motd_banner_text=$(echo "$motd_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
motd_banner_text=$(echo "$motd_banner_text" | sed 's/\\//g')
formatted=$(echo "$motd_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/motd
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="banner_etc_motd" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - banner_etc_motd
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value motd_banner_text # promote to variable
  set_fact:
    motd_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_motd_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Message of the Day Banner - ensure correct banner
  copy:
    dest: /etc/motd
    content: '{{ motd_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - banner_etc_motd
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-motd_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_motd_banner_text"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-banner_etc_motd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-banner_etc_motd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net" severity="medium">
              <xccdf-1.2:title>Verify Group Ownership of System Login Banner for Remote Connections</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/issue.net</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/issue.net</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper group ownership will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_issue_net" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/issue.net
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_issue_net" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/issue.net
  stat:
    path: /etc/issue.net
  register: file_exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_groupowner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/issue.net
  file:
    path: /etc/issue.net
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_groupowner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_issue_net:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_issue_net_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net" severity="medium">
              <xccdf-1.2:title>Verify ownership of System Login Banner for Remote Connections</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/issue.net</html:code>, run the command:
<html:pre>$ sudo chown root /etc/issue.net </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper ownership will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_issue_net" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/issue.net
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_issue_net" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/issue.net
  stat:
    path: /etc/issue.net
  register: file_exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_owner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/issue.net
  file:
    path: /etc/issue.net
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_owner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_issue_net:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_issue_net_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net" severity="medium">
              <xccdf-1.2:title>Verify permissions on System Login Banner for Remote Connections</xccdf-1.2:title>
              <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/issue.net</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/issue.net</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br/>
Proper permissions will ensure that only root user can modify the banner.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_issue_net" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/issue.net
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_issue_net" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/issue.net
  stat:
    path: /etc/issue.net
  register: file_exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_permissions_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/issue.net
  file:
    path: /etc/issue.net
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_permissions_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_issue_net:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_issue_net_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gui_login_banner">
              <xccdf-1.2:title>Implement a GUI Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description>In the default graphical environment, users logging
directly into the system are greeted with a login screen provided
by the GNOME Display Manager (GDM). The warning banner should be
displayed in this graphical environment for these users.
The following sections describe how to configure the GDM login
banner.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#package_gdm"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" severity="medium">
                <xccdf-1.2:title>Enable GNOME3 Login Warning Banner</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, displaying a login warning banner
in the GNOME Display Manager's login screen can be enabled on the login
screen by setting <html:code>banner-message-enable</html:code> to <html:code>true</html:code>.
<html:br/>
         <html:br/>
To enable, add or edit <html:code>banner-message-enable</html:code> to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
banner-message-enable=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/login-screen/banner-message-enable</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.
The banner text must also be set.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002150</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002122</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271688r1091776_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271680r1091752_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Display of a standardized and approved use notification before granting access to the operating system
ensures privacy and security notification verbiage used is consistent with applicable federal laws,
Executive Orders, directives, policies, regulations, standards, and guidance.
<html:br/>
         <html:br/>
For U.S. Government systems, system use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not exist.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_banner_enabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*banner-message-enable\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)banner-message-enable(\s*=)/#\1banner-message-enable\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/login-screen\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
if grep -q "^\\s*banner-message-enable\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*banner-message-enable\\s*=\\s*.*/banner-message-enable=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-enable=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-enable$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/login-screen/banner-message-enable$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/login-screen/banner-message-enable$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/login-screen/banner-message-enable" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_banner_enabled" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002122
  - DISA-STIG-OL09-00-002150
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(b)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_banner_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Enable GNOME3 Login Warning Banner
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/login-screen
    option: banner-message-enable
    value: 'true'
    create: true
    no_extra_spaces: true
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002122
  - DISA-STIG-OL09-00-002150
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(b)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_banner_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of GNOME banner-message-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/banner-message-enable$
    line: /org/gnome/login-screen/banner-message-enable
    create: true
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002122
  - DISA-STIG-OL09-00-002150
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(b)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_banner_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002122
  - DISA-STIG-OL09-00-002150
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(b)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_banner_enabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_banner_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" severity="medium">
                <xccdf-1.2:title>Set the GNOME3 Login Warning Banner Text</xccdf-1.2:title>
                <xccdf-1.2:description>In the default graphical environment, configuring the login warning banner text
in the GNOME Display Manager's login screen can be configured on the login
screen by setting <html:code>banner-message-text</html:code> to <html:code>'<html:i>APPROVED_BANNER</html:i>'</html:code>
where <html:i>APPROVED_BANNER</html:i> is the approved banner for your environment.
<html:br/>
         <html:br/>
To enable, add or edit <html:code>banner-message-text</html:code> to

<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/login-screen]
banner-message-text='<html:i>APPROVED_BANNER</html:i>'</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/login-screen/banner-message-text</html:pre>

After the settings have been set, run <html:code>dconf update</html:code>.
When entering a warning banner that spans several lines, remember
to begin and end the string with <html:code>'</html:code> and use <html:code>\n</html:code> for new lines.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002151</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271689r1091779_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An appropriate warning message reinforces policy awareness during the logon
process and facilitates possible legal action against attackers.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dconf_gnome_login_banner_text"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm; then

login_banner_text='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newline "tokens". (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "(n)*")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/(n)*/g')
# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
# 5 - Removes the newline "token." (Transforms them into newline escape sequences "\n").
#    ( Needs to be done after 4, otherwise the escapce sequence will become just "n".
login_banner_text=$(echo "$login_banner_text" | sed 's/(n)\*/\\n/g')

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/login-screen\\]" "/etc/dconf/db/" \
                                | grep -v 'distro\|ibus\|local.d' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
then
    if grep -q "^\\s*banner-message-text\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -Ei "s/(^\s*)banner-message-text(\s*=)/#\1banner-message-text\2/g" "${SETTINGSFILES[@]}"
    fi
fi

[ ! -z "${DCONFFILE}" ] &amp;&amp; echo "" &gt;&gt; "${DCONFFILE}"
if ! grep -q "\\[org/gnome/login-screen\\]" "${DCONFFILE}"
then
    printf '%s\n' "[org/gnome/login-screen]" &gt;&gt; ${DCONFFILE}
fi

escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "'${login_banner_text}'")"
if grep -q "^\\s*banner-message-text\\s*=" "${DCONFFILE}"
then
        sed -i "s/\\s*banner-message-text\\s*=\\s*.*/banner-message-text=${escaped_value}/g" "${DCONFFILE}"
    else
        sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-text=${escaped_value}" "${DCONFFILE}"
fi
dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-text$" "/etc/dconf/db/" \
            | grep -v 'distro\|ibus\|local.d' | grep ":" | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
then
    sed -i -E "s|^/org/gnome/login-screen/banner-message-text$|#&amp;|" "${LOCKFILES[@]}"
fi

if ! grep -qr "^/org/gnome/login-screen/banner-message-text$" /etc/dconf/db/local.d/
then
    echo "/org/gnome/login-screen/banner-message-text" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi
dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dconf_gnome_login_banner_text" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002151
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_login_banner_text
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Set the GNOME3 Login Warning Banner Text
  file:
    path: /etc/dconf/db/{{ item }}
    owner: root
    group: root
    mode: 493
    state: directory
  with_items:
  - local.d
  - local.d/locks
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002151
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_login_banner_text
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Set the GNOME3 Login Warning Banner Text
  file:
    path: /etc/dconf/db/local.d/{{ item }}
    owner: root
    group: root
    mode: 420
    state: touch
  with_items:
  - 00-security-settings
  - locks/00-security-settings-lock
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002151
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_login_banner_text
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Set the GNOME3 Login Warning Banner Text
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/login-screen
    option: banner-message-text
    value: '''{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "(n)*") | regex_replace("\\", "") | regex_replace("\(n\)\*", "\\n") }}'''
    create: true
    no_extra_spaces: true
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002151
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_login_banner_text
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Prevent user modification of the GNOME3 Login Warning Banner Text
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/login-screen/banner-message-text$
    line: /org/gnome/login-screen/banner-message-text
    create: true
    state: present
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002151
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_login_banner_text
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy

- name: Dconf Update
  command: dconf update
  when: '"gdm" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002151
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - dconf_gnome_login_banner_text
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dconf_gnome_login_banner_text:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-pam">
            <xccdf-1.2:title>Protect Accounts by Configuring PAM</xccdf-1.2:title>
            <xccdf-1.2:description>PAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
<html:br/>
       <html:br/>
PAM is implemented as a set of shared objects which are
loaded and invoked whenever an application wishes to authenticate a
user. Typically, the application must be running as root in order
to take advantage of PAM, because PAM's modules often need to be able
to access sensitive stores of account information, such as /etc/shadow.
Traditional privileged network listeners
(e.g. sshd) or SUID programs (e.g. sudo) already meet this
requirement. An SUID root application, userhelper, is provided so
that programs which are not SUID or privileged themselves can still
take advantage of PAM.
<html:br/>
       <html:br/>
PAM looks in the directory <html:code>/etc/pam.d</html:code> for
application-specific configuration information. For instance, if
the program login attempts to authenticate a user, then PAM's
libraries follow the instructions in the file <html:code>/etc/pam.d/login</html:code>
to determine what actions should be taken.
<html:br/>
       <html:br/>
One very important file in <html:code>/etc/pam.d</html:code> is
<html:code>/etc/pam.d/system-auth</html:code>. This file, which is included by
many other PAM configuration files, defines 'default' system authentication
measures. Modifying this file is a good way to make far-reaching
authentication changes, for instance when implementing a
centralized authentication service.</xccdf-1.2:description>
            <xccdf-1.2:warning category="functionality">Be careful when making changes to PAM's configuration files.
The syntax for these files is complex, and modifications can
have unexpected consequences. The default configurations shipped
with applications should be sufficient for most users.</xccdf-1.2:warning>
            <xccdf-1.2:warning category="functionality">Running <html:code>authconfig</html:code> or <html:code>system-config-authentication</html:code>
will re-write the PAM configuration files, destroying any manually
made changes and replacing them with a series of system defaults.
One reference to the configuration file syntax can be found at

<html:a href="https://fossies.org/linux/Linux-PAM-docs/doc/sag/Linux-PAM_SAG.pdf">https://fossies.org/linux/Linux-PAM-docs/doc/sag/Linux-PAM_SAG.pdf</html:a>.</xccdf-1.2:warning>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" type="string">
              <xccdf-1.2:title>Password Hashing algorithm</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the system default encryption algorithm for encrypting passwords.
Defines the value set as ENCRYPT_METHOD in /etc/login.defs.</xccdf-1.2:description>
              <xccdf-1.2:value>SHA512</xccdf-1.2:value>
              <xccdf-1.2:value selector="SHA512">SHA512</xccdf-1.2:value>
              <xccdf-1.2:value selector="SHA256">SHA256</xccdf-1.2:value>
              <xccdf-1.2:value selector="yescrypt">YESCRYPT</xccdf-1.2:value>
              <xccdf-1.2:value selector="cis_ubuntu2404">SHA512|YESCRYPT</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" type="string">
              <xccdf-1.2:title>Password Hashing algorithm for pam_unix.so</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the system default encryption algorithm for encrypting passwords.
Defines the hashing algorithm to be used in pam_unix.so.</xccdf-1.2:description>
              <xccdf-1.2:value>sha512</xccdf-1.2:value>
              <xccdf-1.2:value selector="sha512">sha512</xccdf-1.2:value>
              <xccdf-1.2:value selector="yescrypt">yescrypt</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" type="number">
              <xccdf-1.2:title>remember</xccdf-1.2:title>
              <xccdf-1.2:description>The last n passwords for each user are saved in
<html:code>/etc/security/opasswd</html:code> in order to force password change history and
keep the user from alternating between the same password too
frequently.</xccdf-1.2:description>
              <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="24">24</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disallow_bypass_password_sudo" severity="medium">
              <xccdf-1.2:title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</xccdf-1.2:title>
              <xccdf-1.2:description>Verify the operating system is not configured to bypass password requirements for privilege
escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
<html:pre>$ sudo grep pam_succeed_if /etc/pam.d/sudo</html:pre>
If any occurrences of "pam_succeed_if" is returned from the command, this is a finding.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004895</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002364</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271726r1091890_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without re-authentication, users may access resources or perform tasks for which they do not
have authorization. When operating systems provide the capability to escalate a functional
capability, it is critical the user re-authenticate.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_pam"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disallow_bypass_password_sudo"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

sed -i '/pam_succeed_if/d' /etc/pam.d/sudo

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disallow_bypass_password_sudo" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002364
  - NIST-800-53-IA-11
  - disallow_bypass_password_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check for pam_succeed_if entry
  ansible.builtin.lineinfile:
    path: /etc/pam.d/sudo
    create: false
    regexp: pam_succeed_if
    state: absent
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002364
  - NIST-800-53-IA-11
  - disallow_bypass_password_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-disallow_bypass_password_sudo:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_display_login_attempts" severity="low">
              <xccdf-1.2:title>Ensure PAM Displays Last Logon/Access Notification</xccdf-1.2:title>
              <xccdf-1.2:description>To configure the system to notify users of last logon/access using <html:code>pam_lastlog</html:code>,
add or correct the <html:code>pam_lastlog</html:code> settings in <html:code>/etc/pam.d/postlogin</html:code>
to include <html:code>showfailed</html:code> option, such as:
<html:pre>session     required    pam_lastlog.so showfailed</html:pre>
And make sure that the <html:code>silent</html:code> option is not set for this specific line.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general"><html:code>authselect</html:code> contains an authselect feature to easily and properly enable Last Logon
notifications with <html:code>pam_lastlog.so</html:code> module. If a custom profile was created and used
in the system before this authselect feature was available, the new feature can't be used
with this custom profile and the remediation will fail. In this case, the custom profile
should be recreated or manually updated.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Users need to be aware of activity that occurs regarding their account. Providing users with
information regarding the number of unsuccessful attempts that were made to login to their
account allows the user to determine if any unauthorized activity has occurred and gives them
an opportunity to notify administrators.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_pam"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="display_login_attempts"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -f /usr/bin/authselect ]; then
    if authselect list-features sssd | grep -q with-silent-lastlog; then
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi
        authselect disable-feature with-silent-lastlog

        authselect apply-changes -b
    else
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/postlogin")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
        if [ -e "$PAM_FILE_PATH" ] ; then
            PAM_FILE_PATH="$PAM_FILE_PATH"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            

                if ! grep -qP "^\s*session\s+required\s+pam_lastlog.so\s*.*" "$PAM_FILE_PATH"; then
                    # Line matching group + control + module was not found. Check group + module.
                    if [ "$(grep -cP '^\s*session\s+.*\s+pam_lastlog.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                        # The control is updated only if one single line matches.
                        sed -i -E --follow-symlinks "s/^(\s*session\s+).*(\bpam_lastlog.so.*)/\1required \2/" "$PAM_FILE_PATH"
                    else
                        LAST_MATCH_LINE=$(grep -nP "^\s*session\s+.*pam_succeed_if\.so.*" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                        if [ ! -z $LAST_MATCH_LINE ]; then
                            sed -i --follow-symlinks $LAST_MATCH_LINE" a session     required    pam_lastlog.so" "$PAM_FILE_PATH"
                        else
                            echo "session    required    pam_lastlog.so" &gt;&gt; "$PAM_FILE_PATH"
                        fi
                    fi
                fi
                # Check the option
                if ! grep -qP "^\s*session\s+required\s+pam_lastlog.so\s*.*\sshowfailed\b" "$PAM_FILE_PATH"; then
                    sed -i -E --follow-symlinks "/\s*session\s+required\s+pam_lastlog.so.*/ s/$/ showfailed/" "$PAM_FILE_PATH"
                fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$PAM_FILE_PATH was not found" &gt;&amp;2
        fi
        if [ -e "$PAM_FILE_PATH" ] ; then
            PAM_FILE_PATH="$PAM_FILE_PATH"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*session\s+required\s+pam_lastlog.so\s.*\bsilent\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*session.*required.*pam_lastlog.so.*)\ssilent=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$PAM_FILE_PATH was not found" &gt;&amp;2
        fi
    fi
else
    if [ -e "/etc/pam.d/postlogin" ] ; then
            PAM_FILE_PATH="/etc/pam.d/postlogin"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "/etc/pam.d/postlogin")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            

                if ! grep -qP "^\s*session\s+required\s+pam_lastlog.so\s*.*" "$PAM_FILE_PATH"; then
                    # Line matching group + control + module was not found. Check group + module.
                    if [ "$(grep -cP '^\s*session\s+.*\s+pam_lastlog.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                        # The control is updated only if one single line matches.
                        sed -i -E --follow-symlinks "s/^(\s*session\s+).*(\bpam_lastlog.so.*)/\1required \2/" "$PAM_FILE_PATH"
                    else
                        LAST_MATCH_LINE=$(grep -nP "^\s*session\s+.*pam_succeed_if\.so.*" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                        if [ ! -z $LAST_MATCH_LINE ]; then
                            sed -i --follow-symlinks $LAST_MATCH_LINE" a session     required    pam_lastlog.so" "$PAM_FILE_PATH"
                        else
                            echo "session    required    pam_lastlog.so" &gt;&gt; "$PAM_FILE_PATH"
                        fi
                    fi
                fi
                # Check the option
                if ! grep -qP "^\s*session\s+required\s+pam_lastlog.so\s*.*\sshowfailed\b" "$PAM_FILE_PATH"; then
                    sed -i -E --follow-symlinks "/\s*session\s+required\s+pam_lastlog.so.*/ s/$/ showfailed/" "$PAM_FILE_PATH"
                fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "/etc/pam.d/postlogin was not found" &gt;&amp;2
        fi
    if [ -e "/etc/pam.d/postlogin" ] ; then
            PAM_FILE_PATH="/etc/pam.d/postlogin"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "/etc/pam.d/postlogin")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*session\s+required\s+pam_lastlog.so\s.*\bsilent\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*session.*required.*pam_lastlog.so.*)\ssilent=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "/etc/pam.d/postlogin was not found" &gt;&amp;2
        fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="display_login_attempts" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - PCI-DSS-Req-10.2.4
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.4
  - configure_strategy
  - display_login_attempts
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Ensure PAM Displays Last Logon/Access Notification - Check if system relies
    on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.2
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - PCI-DSS-Req-10.2.4
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.4
  - configure_strategy
  - display_login_attempts
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Ensure PAM Displays Last Logon/Access Notification - Collect the Available
    authselect Features
  ansible.builtin.command:
    cmd: authselect list-features sssd
  register: result_authselect_available_features
  changed_when: false
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.2
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - PCI-DSS-Req-10.2.4
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.4
  - configure_strategy
  - display_login_attempts
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Ensure PAM Displays Last Logon/Access Notification - Configure pam_lastlog.so
    Using authselect Feature
  block:

  - name: Ensure PAM Displays Last Logon/Access Notification - Check integrity of
      authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Ensure PAM Displays Last Logon/Access Notification - Informative message
      based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Ensure PAM Displays Last Logon/Access Notification - Get authselect Features
      Currently Enabled
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Ensure PAM Displays Last Logon/Access Notification - Ensure "with-silent-lastlog"
      Feature is Disabled Using authselect Tool
    ansible.builtin.command:
      cmd: authselect disable-feature with-silent-lastlog
    register: result_authselect_disable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is search("with-silent-lastlog")

  - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_disable_feature_cmd is not skipped
    - result_authselect_disable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  - result_authselect_available_features.stdout is search("with-silent-lastlog")
  tags:
  - CJIS-5.5.2
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - PCI-DSS-Req-10.2.4
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.4
  - configure_strategy
  - display_login_attempts
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Ensure PAM Displays Last Logon/Access Notification - Configure pam_lastlog.so
    in appropriate PAM files
  block:

  - name: Ensure PAM Displays Last Logon/Access Notification - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/postlogin

  - name: Ensure PAM Displays Last Logon/Access Notification - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect custom
      profile is used if authselect is present
    block:

    - name: Ensure PAM Displays Last Logon/Access Notification - Check integrity of
        authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Displays Last Logon/Access Notification - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Displays Last Logon/Access Notification - Get authselect current
        profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Displays Last Logon/Access Notification - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Displays Last Logon/Access Notification - Define the new authselect
        custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Displays Last Logon/Access Notification - Get authselect current
        features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Displays Last Logon/Access Notification - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Displays Last Logon/Access Notification - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Displays Last Logon/Access Notification - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Displays Last Logon/Access Notification - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Displays Last Logon/Access Notification - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Displays Last Logon/Access Notification - Change the PAM file
        to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Displays Last Logon/Access Notification - Define a fact for control
      already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: required

  - name: Ensure PAM Displays Last Logon/Access Notification - Check if expected PAM
      module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*session\s+{{ pam_module_control | regex_escape() }}\s+pam_lastlog.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Ensure PAM Displays Last Logon/Access Notification - Include or update the
      PAM module line in {{ pam_file_path }}
    block:

    - name: Ensure PAM Displays Last Logon/Access Notification - Check if required
        PAM module line is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*session\s+.*\s+pam_lastlog.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Ensure PAM Displays Last Logon/Access Notification - Ensure the correct
        control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*session\s+).*(\bpam_lastlog.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Ensure PAM Displays Last Logon/Access Notification - Ensure the required
        PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^\s*session\s+.*pam_succeed_if\.so.*
        line: session    {{ pam_module_control }}    pam_lastlog.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Ensure PAM Displays Last Logon/Access Notification - Define a fact for control
      already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: required

  - name: Ensure PAM Displays Last Logon/Access Notification - Check if the required
      PAM module option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*session\s+{{ pam_module_control | regex_escape() }}\s+pam_lastlog.so\s*.*\sshowfailed\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_display_login_attempts_option_present

  - name: Ensure PAM Displays Last Logon/Access Notification - Ensure the "showfailed"
      PAM option for "pam_lastlog.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*session\s+{{ pam_module_control | regex_escape() }}\s+pam_lastlog.so.*)
      line: \1 showfailed
      state: present
    register: result_pam_display_login_attempts_add
    when:
    - result_pam_module_display_login_attempts_option_present.found == 0

  - name: Ensure PAM Displays Last Logon/Access Notification - Define a fact for control
      already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: required

  - name: Ensure PAM Displays Last Logon/Access Notification - Ensure the "silent"
      option from "pam_lastlog.so" is not present in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*session.*{{ pam_module_control | regex_escape() }}.*pam_lastlog.so.*)\bsilent\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.2
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - PCI-DSS-Req-10.2.4
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.4
  - configure_strategy
  - display_login_attempts
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-display_login_attempts:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-display_login_attempts_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_locking_out_password_attempts">
              <xccdf-1.2:title>Set Lockouts for Failed Password Attempts</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>pam_faillock</html:code> PAM module provides the capability to
lock out user accounts after a number of failed login attempts. Its
documentation is available in
<html:code>/usr/share/doc/pam-VERSION/txts/README.pam_faillock</html:code>.
<html:br/>
        <html:br/>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks.</xccdf-1.2:warning>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" type="number">
                <xccdf-1.2:title>fail_deny</xccdf-1.2:title>
                <xccdf-1.2:description>Number of failed login attempts before account lockout</xccdf-1.2:description>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value>3</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" type="string">
                <xccdf-1.2:title>faillock directory</xccdf-1.2:title>
                <xccdf-1.2:description>The directory where the user files with the failure records are kept</xccdf-1.2:description>
                <xccdf-1.2:value selector="ol8">/var/log/faillock</xccdf-1.2:value>
                <xccdf-1.2:value>/var/log/faillock</xccdf-1.2:value>
                <xccdf-1.2:value selector="run">/var/run/faillock</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" type="number">
                <xccdf-1.2:title>fail_interval</xccdf-1.2:title>
                <xccdf-1.2:description>Interval for counting failed login attempts before account lockout</xccdf-1.2:description>
                <xccdf-1.2:value selector="100000000">100000000</xccdf-1.2:value>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value>900</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" type="number">
                <xccdf-1.2:title>fail_unlock_time</xccdf-1.2:title>
                <xccdf-1.2:description>Seconds before automatic unlocking or permanently locking after excessive failed logins</xccdf-1.2:description>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="600">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="604800">604800</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value selector="300">300</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="never">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_tally2_unlock_time" type="number">
                <xccdf-1.2:title>tally2_unlock_time</xccdf-1.2:title>
                <xccdf-1.2:description>Seconds before automatic unlocking or permanently locking after excessive failed logins</xccdf-1.2:description>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="600">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="604800">604800</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="never">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember" type="number">
                <xccdf-1.2:title>pwhistory_remember</xccdf-1.2:title>
                <xccdf-1.2:description>Prevent password re-use using password history lookup</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value selector="9">9</xccdf-1.2:value>
                <xccdf-1.2:value selector="24">24</xccdf-1.2:value>
                <xccdf-1.2:value>5</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" type="string">
                <xccdf-1.2:title>PAM pwhistory remember - control flag</xccdf-1.2:title>
                <xccdf-1.2:description>'Specify the control flag required for password remember requirement. If multiple
values are allowed write them separated by commas as in "required,requisite",
for remediations the first value will be taken'</xccdf-1.2:description>
                <xccdf-1.2:value selector="required">required</xccdf-1.2:value>
                <xccdf-1.2:value selector="optional">optional</xccdf-1.2:value>
                <xccdf-1.2:value selector="requisite">requisite</xccdf-1.2:value>
                <xccdf-1.2:value selector="sufficient">sufficient</xccdf-1.2:value>
                <xccdf-1.2:value selector="binding">binding</xccdf-1.2:value>
                <xccdf-1.2:value selector="ol8">required,requisite</xccdf-1.2:value>
                <xccdf-1.2:value selector="requisite_or_required">requisite,required</xccdf-1.2:value>
                <xccdf-1.2:value>requisite</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_tally2" type="number">
                <xccdf-1.2:title>tally2</xccdf-1.2:title>
                <xccdf-1.2:description>Number of failed login attempts</xccdf-1.2:description>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value>3</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" severity="medium">
                <xccdf-1.2:title>Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.</xccdf-1.2:title>
                <xccdf-1.2:description>The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271838r1092226_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent
password guessing attacks.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_password_pam_faillock_password_auth" complexity="low" disruption="low" reboot="false" strategy="enable">
if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="account_password_pam_faillock_password_auth" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  tags:
  - DISA-STIG-OL09-00-003012
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Remediation where authselect tool is present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Informative message based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Ensure "with-faillock" feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when: result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003012
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Remediation where authselect tool is not present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Enable pam_faillock.so preauth editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Enable pam_faillock.so authfail editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Enable pam_faillock.so account section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when: not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003012
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_password_pam_faillock_password_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_password_pam_faillock_password_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" severity="medium">
                <xccdf-1.2:title>Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.</xccdf-1.2:title>
                <xccdf-1.2:description>The pam_faillock.so module must be loaded in preauth in /etc/pam.d/system-auth.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003011</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271837r1092223_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent
password guessing attacks.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_password_pam_faillock_system_auth" complexity="low" disruption="low" reboot="false" strategy="enable">
if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="account_password_pam_faillock_system_auth" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
    File. - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  tags:
  - DISA-STIG-OL09-00-003011
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
    File. - Remediation where authselect tool is present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Informative message based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Ensure "with-faillock" feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when: result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003011
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
    File. - Remediation where authselect tool is not present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Enable pam_faillock.so preauth editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Enable pam_faillock.so authfail editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Enable pam_faillock.so account section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when: not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003011
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_password_pam_faillock_system_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_password_pam_faillock_system_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir" severity="medium">
                <xccdf-1.2:title>An SELinux Context must be configured for the pam_faillock.so records directory</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>dir</html:code> configuration option in PAM pam_faillock.so module defines where the lockout
records is stored. The configured directory must have the correct SELinux context.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271836r1092637_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Not having the correct SELinux context on the pam_faillock.so records directory may lead to
unauthorized access to the directory.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_password_selinux_faillock_dir"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

FAILLOCK_CONF_FILES="/etc/security/faillock.conf /etc/pam.d/system-auth /etc/pam.d/password-auth"
faillock_dirs=$(grep -oP "^\s*(?:auth.*pam_faillock.so.*)?dir\s*=\s*(\S+)" $FAILLOCK_CONF_FILES \
               | sed -r 's/.*=\s*(\S+)/\1/')

if [ -n "$faillock_dirs" ]; then
    for dir in $faillock_dirs; do
        if ! semanage fcontext -a -t faillog_t "$dir(/.*)?"; then
            semanage fcontext -m -t faillog_t "$dir(/.*)?"
        fi
        if [ ! -e $dir ]; then
            mkdir -p $dir
        fi
        restorecon -R -v $dir
    done
else
echo "
The pam_faillock.so dir option is not set in the system.
If this is not expected, make sure pam_faillock.so is properly configured."
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="account_password_selinux_faillock_dir" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: An SELinux Context must be configured for the pam_faillock.so records directory
    - Get directories from faillock
  ansible.builtin.shell: grep -oP '^\s*(?:auth.*pam_faillock.so.*)?dir\s*=\s*(\S+)'
    "{{ item }}" | sed -r 's/.*=\s*(\S+)/\1/'
  register: faillock_output
  with_items:
  - /etc/security/faillock.conf
  - /etc/pam.d/system-auth
  - /etc/pam.d/password-auth
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: An SELinux Context must be configured for the pam_faillock.so records directory
    - Create a list directories from faillock
  ansible.builtin.set_fact:
    list_faillock_dir: '{{ faillock_output.results | map(attribute=''stdout_lines'')
      | flatten }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: An SELinux Context must be configured for the pam_faillock.so records directory
    - Create directories for faillock
  ansible.builtin.file:
    path: '{{ item }}'
    state: directory
  with_items: '{{ list_faillock_dir }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - item != ""
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: An SELinux Context must be configured for the pam_faillock.so records directory
    - Set up SELinux context for faillock
  ansible.builtin.shell: |-
    if ! semanage fcontext -a -t faillog_t "{{ item }}(/.*)?"; then
      semanage fcontext -m -t faillog_t "{{ item }}(/.*)?"
    fi
  with_items: '{{ list_faillock_dir }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - item != ""
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: An SELinux Context must be configured for the pam_faillock.so records directory
    - Restore SELinux context
  ansible.builtin.command: restorecon -R -v "{{ item }}"
  with_items: '{{ list_faillock_dir }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - item != ""
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: An SELinux Context must be configured for the pam_faillock.so records directory
    - Verify pam_faillock.so configuration
  ansible.builtin.debug:
    msg: |-
      "The pam_faillock.so dir option is not set in the system.
      If this is not expected, make sure pam_faillock.so is properly configured."
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - list_faillock_dir | length == 0
  tags:
  - DISA-STIG-OL09-00-003010
  - NIST-800-53-AC-7 (a)
  - account_password_selinux_faillock_dir
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_password_selinux_faillock_dir:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_password_selinux_faillock_dir_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit" severity="medium">
                <xccdf-1.2:title>Account Lockouts Must Be Logged</xccdf-1.2:title>
                <xccdf-1.2:description>PAM faillock locks an account due to excessive password failures, this event must be logged.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule is deprecated in favor of the <html:code>accounts_passwords_pam_faillock_audit</html:code> rule.Please consider replacing this rule in your files as it is not expected to receive
updates as of version <html:code>0.1.65</html:code>.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Without auditing of these events it may be harder or impossible to identify what an attacker did after an attack.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_passwords_pam_faillock_audit">
if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*audit"
    line="audit"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\baudit\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\baudit\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*audit' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ audit/' "$pam_file"
        fi
    done
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="account_passwords_pam_faillock_audit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Account Lockouts Must Be Logged - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Remediation where authselect tool is present
  block:

  - name: Account Lockouts Must Be Logged - Check integrity of authselect current
      profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Account Lockouts Must Be Logged - Informative message based on the authselect
      integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Account Lockouts Must Be Logged - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Account Lockouts Must Be Logged - Ensure "with-faillock" feature is enabled
      using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when: result_authselect_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Remediation where authselect tool is not
    present
  block:

  - name: Account Lockouts Must Be Logged - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Account Lockouts Must Be Logged - Enable pam_faillock.so preauth editing
      PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Account Lockouts Must Be Logged - Enable pam_faillock.so authfail editing
      PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Account Lockouts Must Be Logged - Enable pam_faillock.so account section
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when: not result_authselect_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
    in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*audit
    line: audit
    state: present
  when: result_faillock_conf_check.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
    not in PAM files
  block:

  - name: Account Lockouts Must Be Logged - Check if /etc/pam.d/system-auth file is
      present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Account Lockouts Must Be Logged - Check the proper remediation for the system
    block:

    - name: Account Lockouts Must Be Logged - Define the PAM file to be edited as
        a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Account Lockouts Must Be Logged - Check if system relies on authselect
        tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Account Lockouts Must Be Logged - Ensure authselect custom profile is
        used if authselect is present
      block:

      - name: Account Lockouts Must Be Logged - Check integrity of authselect current
          profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Account Lockouts Must Be Logged - Informative message based on the authselect
          integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Account Lockouts Must Be Logged - Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Account Lockouts Must Be Logged - Define the current authselect profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Account Lockouts Must Be Logged - Define the new authselect custom profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Account Lockouts Must Be Logged - Get authselect current features to
          also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Check if any custom profile with the
          same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
          is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Restore the authselect features in
          the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
          to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Account Lockouts Must Be Logged - Define a fact for control already filtered
        in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Account Lockouts Must Be Logged - Ensure the "audit" option from "pam_faillock.so"
        is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\baudit\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Account Lockouts Must Be Logged - Check if /etc/pam.d/password-auth file
      is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Account Lockouts Must Be Logged - Check the proper remediation for the system
    block:

    - name: Account Lockouts Must Be Logged - Define the PAM file to be edited as
        a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Account Lockouts Must Be Logged - Check if system relies on authselect
        tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Account Lockouts Must Be Logged - Ensure authselect custom profile is
        used if authselect is present
      block:

      - name: Account Lockouts Must Be Logged - Check integrity of authselect current
          profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Account Lockouts Must Be Logged - Informative message based on the authselect
          integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Account Lockouts Must Be Logged - Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Account Lockouts Must Be Logged - Define the current authselect profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Account Lockouts Must Be Logged - Define the new authselect custom profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Account Lockouts Must Be Logged - Get authselect current features to
          also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Check if any custom profile with the
          same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
          is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Restore the authselect features in
          the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
          to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Account Lockouts Must Be Logged - Define a fact for control already filtered
        in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Account Lockouts Must Be Logged - Ensure the "audit" option from "pam_faillock.so"
        is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\baudit\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when: result_faillock_conf_check.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
    in PAM files
  block:

  - name: Account Lockouts Must Be Logged - Check if pam_faillock.so audit parameter
      is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*audit
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_audit_parameter_is_present

  - name: Account Lockouts Must Be Logged - Ensure the inclusion of pam_faillock.so
      preauth audit parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 audit
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_audit_parameter_is_present.found == 0
  when: not result_faillock_conf_check.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_passwords_pam_faillock_audit:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_passwords_pam_faillock_audit_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_dir" severity="medium">
                <xccdf-1.2:title>Account Lockouts Must Persist</xccdf-1.2:title>
                <xccdf-1.2:description>By setting a `dir` in the faillock configuration account lockouts will persist across reboots.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule is deprecated in favor of the <html:code>accounts_passwords_pam_faillock_dir</html:code> rule.Please consider replacing this rule in your files as it is not expected to receive
updates as of version <html:code>0.1.65</html:code>.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (ia)</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Having lockouts persist across reboots ensures that account is only unlocked by an administrator.
If the lockouts did not persist across reboots an attack could simply reboot the system to continue brute force attacks against the accounts on the system.
</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_passwords_pam_faillock_dir_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" severity="medium">
                <xccdf-1.2:title>Limit Password Reuse: password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code>remember</html:code> option for the <html:code>pam_pwhistory</html:code> PAM module.
<html:br/>
         <html:br/>

On systems with newer versions of <html:code>authselect</html:code>, the <html:code>pam_pwhistory</html:code> PAM module
can be enabled via authselect feature:
<html:pre>authselect enable-feature with-pwhistory</html:pre>

Otherwise, it should be enabled using an authselect custom profile.
<html:br/>
         <html:br/>
Newer systems also have the <html:code>/etc/security/pwhistory.conf</html:code> file for setting
<html:code>pam_pwhistory</html:code> module options. This file should be used whenever available.
Otherwise, the <html:code>pam_pwhistory</html:code> module options can be set in PAM files.
<html:br/>
         <html:br/>
The value for <html:code>remember</html:code> option must be equal or greater than
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="general">Newer versions of <html:code>authselect</html:code> contain an authselect feature to easily and properly
enable <html:code>pam_pwhistory.so</html:code> module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.
If a custom profile was created and used in the system before this authselect feature was
available, the new feature can't be used with this custom profile and the
remediation will fail. In this case, the custom profile should be recreated or manually
updated.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing re-use of previous passwords helps ensure that a compromised password is not
re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwhistory_remember_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_remember='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>'
var_password_pam_remember_control_flag='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>'


var_password_pam_remember_control_flag="$(echo $var_password_pam_remember_control_flag | cut -d \, -f 1)"

if [ -f /usr/bin/authselect ]; then
    if authselect list-features sssd | grep -q with-pwhistory; then
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi
        authselect enable-feature with-pwhistory

        authselect apply-changes -b
    else
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
        
        if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "$PAM_FILE_PATH"
            else
                LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                if [ ! -z $LAST_MATCH_LINE ]; then
                    sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "$PAM_FILE_PATH"
                else
                    echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
                fi
            fi
        fi
    fi
else

    
    if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "/etc/pam.d/password-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "/etc/pam.d/password-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "/etc/pam.d/password-auth"
        else
            LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "/etc/pam.d/password-auth" | tail -n 1 | cut -d: -f 1)
            if [ ! -z $LAST_MATCH_LINE ]; then
                sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "/etc/pam.d/password-auth"
            else
                echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "/etc/pam.d/password-auth"
            fi
        fi
    fi

fi

PWHISTORY_CONF="/etc/security/pwhistory.conf"
if [ -f $PWHISTORY_CONF ]; then
    regex="^\s*remember\s*="
    line="remember = $var_password_pam_remember"
    if ! grep -q $regex $PWHISTORY_CONF; then
        echo $line &gt;&gt; $PWHISTORY_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(remember\s*=\s*\)\(\S\+\)|\1'"$var_password_pam_remember"'|g' $PWHISTORY_CONF
    fi
    if [ -e "/etc/pam.d/password-auth" ] ; then
        PAM_FILE_PATH="/etc/pam.d/password-auth"
        if [ -f /usr/bin/authselect ]; then
            
            if ! authselect check; then
            echo "
            authselect integrity check failed. Remediation aborted!
            This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
            It is not recommended to manually edit the PAM files when authselect tool is available.
            In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
            exit 1
            fi

            CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
            # If not already in use, a custom profile is created preserving the enabled features.
            if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                # The "local" profile does not contain essential security features required by multiple Benchmarks.
                # If currently used, it is replaced by "sssd", which is the best option in this case.
                if [[ $CURRENT_PROFILE == local ]]; then
                    CURRENT_PROFILE="sssd"
                fi
                authselect create-profile hardening -b $CURRENT_PROFILE
                CURRENT_PROFILE="custom/hardening"
                
                authselect apply-changes -b --backup=before-hardening-custom-profile
                authselect select $CURRENT_PROFILE
                for feature in $ENABLED_FEATURES; do
                    authselect enable-feature $feature;
                done
                
                authselect apply-changes -b --backup=after-hardening-custom-profile
            fi
            PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
            PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

            authselect apply-changes -b
        fi
        
    if grep -qP "^\s*password\s.*\bpam_pwhistory.so\s.*\bremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "s/(.*password.*pam_pwhistory.so.*)\bremember\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
    fi
        if [ -f /usr/bin/authselect ]; then
            
            authselect apply-changes -b
        fi
    else
        echo "/etc/pam.d/password-auth was not found" &gt;&amp;2
    fi
else
    PAM_FILE_PATH="/etc/pam.d/password-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_remember/" "$PAM_FILE_PATH"
    else
        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
    fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwhistory_remember_password_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_remember # promote to variable
  set_fact:
    var_password_pam_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_password_pam_remember_control_flag # promote to variable
  set_fact:
    var_password_pam_remember_control_flag: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>
  tags:
    - always

- name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
    tool'
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Collect the available authselect features'
  ansible.builtin.command:
    cmd: authselect list-features sssd
  register: result_authselect_available_features
  changed_when: false
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so using authselect
    feature'
  block:

  - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current
      profile'
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: 'Limit Password Reuse: password-auth - Informative message based on the
      authselect integrity check result'
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: 'Limit Password Reuse: password-auth - Get authselect current features'
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: 'Limit Password Reuse: password-auth - Ensure "with-pwhistory" feature is
      enabled using authselect tool'
    ansible.builtin.command:
      cmd: authselect enable-feature with-pwhistory
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-pwhistory")

  - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  - result_authselect_available_features.stdout is search("with-pwhistory")
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so in appropriate
    PAM files'
  block:

  - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited
      as a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile
      is used if authselect is present'
    block:

    - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: 'Limit Password Reuse: password-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: password-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: password-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Get authselect current features
        to also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Restore the authselect features
        in the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: password-auth - Define a fact for control already
      filtered in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0]
        }}'

  - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line
      is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: password-auth - Include or update the PAM module
      line in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: password-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: password-auth - Ensure the correct control for
        the required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module
        line is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^password.*requisite.*pam_pwquality\.so
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - |
    (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Check the presence of /etc/security/pwhistory.conf
    file'
  ansible.builtin.stat:
    path: /etc/security/pwhistory.conf
  register: result_pwhistory_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured
    in /etc/security/pwhistory.conf file'
  block:

  - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember
      parameter in /etc/security/pwhistory.conf'
    ansible.builtin.lineinfile:
      path: /etc/security/pwhistory.conf
      regexp: ^\s*remember\s*=
      line: remember = {{ var_password_pam_remember }}
      state: present

  - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember
      parameter is removed from PAM files'
    block:

    - name: 'Limit Password Reuse: password-auth - Check if /etc/pam.d/password-auth
        file is present'
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_file_present

    - name: 'Limit Password Reuse: password-auth - Check the proper remediation for
        the system'
      block:

      - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited
          as a local fact'
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
          tool'
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile
          is used if authselect is present'
        block:

        - name: 'Limit Password Reuse: password-auth - Check integrity of authselect
            current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: 'Limit Password Reuse: password-auth - Informative message based on
            the authselect integrity check result'
          ansible.builtin.assert:
            that:
            - result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: password-auth - Define the current authselect
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match("custom/")

        - name: 'Limit Password Reuse: password-auth - Define the new authselect custom
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match("custom/")

        - name: 'Limit Password Reuse: password-auth - Get authselect current features
            to also enable them in the custom profile'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: password-auth - Check if any custom profile
            with the same name was already created'
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: password-auth - Create an authselect custom
            profile based on the current profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match("^(custom/|local)")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Create an authselect custom
            profile based on sssd profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_check_cmd is success
          - authselect_current_profile is match("local")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom
            profile is selected'
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: password-auth - Restore the authselect features
            in the custom profile'
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
            according to the custom authselect profile'
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
        when:
        - result_authselect_present.stat.exists

      - name: 'Limit Password Reuse: password-auth - Define a fact for control already
          filtered in case filters are used'
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: 'Limit Password Reuse: password-auth - Ensure the "remember" option
          from "pam_pwhistory.so" is not present in {{ pam_file_path }}'
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal

      - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
          applied'
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured
    in PAM files'
  block:

  - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited
      as a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile
      is used if authselect is present'
    block:

    - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: 'Limit Password Reuse: password-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: password-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: password-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Get authselect current features
        to also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Restore the authselect features
        in the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: password-auth - Define a fact for control already
      filtered in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line
      is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: password-auth - Include or update the PAM module
      line in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: password-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: password-auth - Ensure the correct control for
        the required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module
        line is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: 'Limit Password Reuse: password-auth - Define a fact for control already
      filtered in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: password-auth - Check if the required PAM module
      option is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present

  - name: 'Limit Password Reuse: password-auth - Ensure the "remember" PAM option
      for "pam_pwhistory.so" is included in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
      line: \1 remember={{ var_password_pam_remember }}
      state: present
    register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_add
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found
      == 0

  - name: 'Limit Password Reuse: password-auth - Ensure the required value for "remember"
      PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
      line: \1\2={{ var_password_pam_remember }} \3
    register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_edit
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found
      &gt; 0

  - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - (result_pam_remember_add is defined and result_pam_remember_add.changed) or
      (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - not result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember_control_flag:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag"/>
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" severity="medium">
                <xccdf-1.2:title>Limit Password Reuse: system-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code>remember</html:code> option for the <html:code>pam_pwhistory</html:code> PAM module.
<html:br/>
         <html:br/>

On systems with newer versions of <html:code>authselect</html:code>, the <html:code>pam_pwhistory</html:code> PAM module
can be enabled via authselect feature:
<html:pre>authselect enable-feature with-pwhistory</html:pre>

Otherwise, it should be enabled using an authselect custom profile.
<html:br/>
         <html:br/>
Newer systems also have the <html:code>/etc/security/pwhistory.conf</html:code> file for setting
<html:code>pam_pwhistory</html:code> module options. This file should be used whenever available.
Otherwise, the <html:code>pam_pwhistory</html:code> module options can be set in PAM files.
<html:br/>
         <html:br/>
The value for <html:code>remember</html:code> option must be equal or greater than
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="general">Newer versions of <html:code>authselect</html:code> contain an authselect feature to easily and properly
enable <html:code>pam_pwhistory.so</html:code> module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing re-use of previous passwords helps ensure that a compromised password is not
re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwhistory_remember_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_remember='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>'
var_password_pam_remember_control_flag='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>'


var_password_pam_remember_control_flag="$(echo $var_password_pam_remember_control_flag | cut -d \, -f 1)"

if [ -f /usr/bin/authselect ]; then
    if authselect list-features sssd | grep -q with-pwhistory; then
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi
        authselect enable-feature with-pwhistory

        authselect apply-changes -b
    else
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
        
        if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "$PAM_FILE_PATH"
            else
                LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                if [ ! -z $LAST_MATCH_LINE ]; then
                    sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "$PAM_FILE_PATH"
                else
                    echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
                fi
            fi
        fi
    fi
else

    
    if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "/etc/pam.d/system-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "/etc/pam.d/system-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "/etc/pam.d/system-auth"
        else
            LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "/etc/pam.d/system-auth" | tail -n 1 | cut -d: -f 1)
            if [ ! -z $LAST_MATCH_LINE ]; then
                sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "/etc/pam.d/system-auth"
            else
                echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "/etc/pam.d/system-auth"
            fi
        fi
    fi

fi

PWHISTORY_CONF="/etc/security/pwhistory.conf"
if [ -f $PWHISTORY_CONF ]; then
    regex="^\s*remember\s*="
    line="remember = $var_password_pam_remember"
    if ! grep -q $regex $PWHISTORY_CONF; then
        echo $line &gt;&gt; $PWHISTORY_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(remember\s*=\s*\)\(\S\+\)|\1'"$var_password_pam_remember"'|g' $PWHISTORY_CONF
    fi
    if [ -e "/etc/pam.d/system-auth" ] ; then
        PAM_FILE_PATH="/etc/pam.d/system-auth"
        if [ -f /usr/bin/authselect ]; then
            
            if ! authselect check; then
            echo "
            authselect integrity check failed. Remediation aborted!
            This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
            It is not recommended to manually edit the PAM files when authselect tool is available.
            In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
            exit 1
            fi

            CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
            # If not already in use, a custom profile is created preserving the enabled features.
            if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                # The "local" profile does not contain essential security features required by multiple Benchmarks.
                # If currently used, it is replaced by "sssd", which is the best option in this case.
                if [[ $CURRENT_PROFILE == local ]]; then
                    CURRENT_PROFILE="sssd"
                fi
                authselect create-profile hardening -b $CURRENT_PROFILE
                CURRENT_PROFILE="custom/hardening"
                
                authselect apply-changes -b --backup=before-hardening-custom-profile
                authselect select $CURRENT_PROFILE
                for feature in $ENABLED_FEATURES; do
                    authselect enable-feature $feature;
                done
                
                authselect apply-changes -b --backup=after-hardening-custom-profile
            fi
            PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
            PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

            authselect apply-changes -b
        fi
        
    if grep -qP "^\s*password\s.*\bpam_pwhistory.so\s.*\bremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "s/(.*password.*pam_pwhistory.so.*)\bremember\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
    fi
        if [ -f /usr/bin/authselect ]; then
            
            authselect apply-changes -b
        fi
    else
        echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
    fi
else
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_remember/" "$PAM_FILE_PATH"
    else
        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
    fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwhistory_remember_system_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_remember # promote to variable
  set_fact:
    var_password_pam_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_password_pam_remember_control_flag # promote to variable
  set_fact:
    var_password_pam_remember_control_flag: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>
  tags:
    - always

- name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
    tool'
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Collect the available authselect features'
  ansible.builtin.command:
    cmd: authselect list-features sssd
  register: result_authselect_available_features
  changed_when: false
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so using authselect
    feature'
  block:

  - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current
      profile'
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect
      integrity check result'
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: 'Limit Password Reuse: system-auth - Get authselect current features'
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: 'Limit Password Reuse: system-auth - Ensure "with-pwhistory" feature is
      enabled using authselect tool'
    ansible.builtin.command:
      cmd: authselect enable-feature with-pwhistory
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-pwhistory")

  - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  - result_authselect_available_features.stdout is search("with-pwhistory")
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so in appropriate
    PAM files'
  block:

  - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as
      a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is
      used if authselect is present'
    block:

    - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: 'Limit Password Reuse: system-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: system-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: system-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Get authselect current features to
        also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Restore the authselect features in
        the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered
      in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0]
        }}'

  - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is
      present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line
      in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: system-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the
        required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line
        is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^password.*requisite.*pam_pwquality\.so
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - |
    (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Check the presence of /etc/security/pwhistory.conf
    file'
  ansible.builtin.stat:
    path: /etc/security/pwhistory.conf
  register: result_pwhistory_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured
    in /etc/security/pwhistory.conf file'
  block:

  - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember
      parameter in /etc/security/pwhistory.conf'
    ansible.builtin.lineinfile:
      path: /etc/security/pwhistory.conf
      regexp: ^\s*remember\s*=
      line: remember = {{ var_password_pam_remember }}
      state: present

  - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember
      parameter is removed from PAM files'
    block:

    - name: 'Limit Password Reuse: system-auth - Check if /etc/pam.d/system-auth file
        is present'
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_file_present

    - name: 'Limit Password Reuse: system-auth - Check the proper remediation for
        the system'
      block:

      - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited
          as a local fact'
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
          tool'
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile
          is used if authselect is present'
        block:

        - name: 'Limit Password Reuse: system-auth - Check integrity of authselect
            current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: 'Limit Password Reuse: system-auth - Informative message based on
            the authselect integrity check result'
          ansible.builtin.assert:
            that:
            - result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: system-auth - Define the current authselect
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match("custom/")

        - name: 'Limit Password Reuse: system-auth - Define the new authselect custom
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match("custom/")

        - name: 'Limit Password Reuse: system-auth - Get authselect current features
            to also enable them in the custom profile'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: system-auth - Check if any custom profile with
            the same name was already created'
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
            based on the current profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match("^(custom/|local)")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
            based on sssd profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_check_cmd is success
          - authselect_current_profile is match("local")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom
            profile is selected'
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: system-auth - Restore the authselect features
            in the custom profile'
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
            according to the custom authselect profile'
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
        when:
        - result_authselect_present.stat.exists

      - name: 'Limit Password Reuse: system-auth - Define a fact for control already
          filtered in case filters are used'
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: 'Limit Password Reuse: system-auth - Ensure the "remember" option from
          "pam_pwhistory.so" is not present in {{ pam_file_path }}'
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal

      - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured
    in PAM files'
  block:

  - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as
      a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is
      used if authselect is present'
    block:

    - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: 'Limit Password Reuse: system-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: system-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: system-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Get authselect current features to
        also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Restore the authselect features in
        the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered
      in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is
      present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line
      in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: system-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the
        required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line
        is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered
      in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: system-auth - Check if the required PAM module option
      is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present

  - name: 'Limit Password Reuse: system-auth - Ensure the "remember" PAM option for
      "pam_pwhistory.so" is included in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
      line: \1 remember={{ var_password_pam_remember }}
      state: present
    register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_add
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found
      == 0

  - name: 'Limit Password Reuse: system-auth - Ensure the required value for "remember"
      PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
      line: \1\2={{ var_password_pam_remember }} \3
    register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_edit
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found
      &gt; 0

  - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - (result_pam_remember_add is defined and result_pam_remember_add.changed) or
      (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - not result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember_control_flag:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag"/>
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" severity="medium">
                <xccdf-1.2:title>Limit Password Reuse</xccdf-1.2:title>
                <xccdf-1.2:description>Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code>remember</html:code> option for the <html:code>pam_unix</html:code> or <html:code>pam_pwhistory</html:code> PAM modules.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="general">Newer versions of <html:code>authselect</html:code> contain an authselect feature to easily and properly
enable <html:code>pam_pwhistory.so</html:code> module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing re-use of previous passwords helps ensure that a compromised password is not
re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_unix_remember"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_unix_remember='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>'






if [ -f /usr/bin/authselect ]; then
    if authselect list-features sssd | grep -q with-pwhistory; then
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi
        authselect enable-feature with-pwhistory

        authselect apply-changes -b
    else
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
        
        if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
            else
                LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                if [ ! -z $LAST_MATCH_LINE ]; then
                    sed -i --follow-symlinks $LAST_MATCH_LINE" a password     requisite    pam_pwhistory.so" "$PAM_FILE_PATH"
                else
                    echo "password    requisite    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
                fi
            fi
        fi
    fi
else

    
    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "/etc/pam.d/system-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "/etc/pam.d/system-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "/etc/pam.d/system-auth"
        else
            LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "/etc/pam.d/system-auth" | tail -n 1 | cut -d: -f 1)
            if [ ! -z $LAST_MATCH_LINE ]; then
                sed -i --follow-symlinks $LAST_MATCH_LINE" a password     requisite    pam_pwhistory.so" "/etc/pam.d/system-auth"
            else
                echo "password    requisite    pam_pwhistory.so" &gt;&gt; "/etc/pam.d/system-auth"
            fi
        fi
    fi

fi

PWHISTORY_CONF="/etc/security/pwhistory.conf"
if [ -f $PWHISTORY_CONF ]; then
    regex="^\s*remember\s*="
    line="remember = $var_password_pam_unix_remember"
    if ! grep -q $regex $PWHISTORY_CONF; then
        echo $line &gt;&gt; $PWHISTORY_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(remember\s*=\s*\)\(\S\+\)|\1'"$var_password_pam_unix_remember"'|g' $PWHISTORY_CONF
    fi
    if [ -e "/etc/pam.d/system-auth" ] ; then
        PAM_FILE_PATH="/etc/pam.d/system-auth"
        if [ -f /usr/bin/authselect ]; then
            
            if ! authselect check; then
            echo "
            authselect integrity check failed. Remediation aborted!
            This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
            It is not recommended to manually edit the PAM files when authselect tool is available.
            In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
            exit 1
            fi

            CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
            # If not already in use, a custom profile is created preserving the enabled features.
            if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                # The "local" profile does not contain essential security features required by multiple Benchmarks.
                # If currently used, it is replaced by "sssd", which is the best option in this case.
                if [[ $CURRENT_PROFILE == local ]]; then
                    CURRENT_PROFILE="sssd"
                fi
                authselect create-profile hardening -b $CURRENT_PROFILE
                CURRENT_PROFILE="custom/hardening"
                
                authselect apply-changes -b --backup=before-hardening-custom-profile
                authselect select $CURRENT_PROFILE
                for feature in $ENABLED_FEATURES; do
                    authselect enable-feature $feature;
                done
                
                authselect apply-changes -b --backup=after-hardening-custom-profile
            fi
            PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
            PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

            authselect apply-changes -b
        fi
        
    if grep -qP "^\s*password\s.*\bpam_pwhistory.so\s.*\bremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "s/(.*password.*pam_pwhistory.so.*)\bremember\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
    fi
        if [ -f /usr/bin/authselect ]; then
            
            authselect apply-changes -b
        fi
    else
        echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
    fi
else
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_unix_remember/" "$PAM_FILE_PATH"
    else
        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_unix_remember \3/" "$PAM_FILE_PATH"
    fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_unix_remember" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_remember # promote to variable
  set_fact:
    var_password_pam_unix_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>
  tags:
    - always

- name: Limit Password Reuse - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Limit Password Reuse - Collect the available authselect features
  ansible.builtin.command:
    cmd: authselect list-features sssd
  register: result_authselect_available_features
  changed_when: false
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Limit Password Reuse - Enable pam_pwhistory.so using authselect feature
  block:

  - name: Limit Password Reuse - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Limit Password Reuse - Informative message based on the authselect integrity
      check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Limit Password Reuse - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Limit Password Reuse - Ensure "with-pwhistory" feature is enabled using
      authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-pwhistory
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-pwhistory")

  - name: Limit Password Reuse - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  - result_authselect_available_features.stdout is search("with-pwhistory")
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Limit Password Reuse - Enable pam_pwhistory.so in appropriate PAM files
  block:

  - name: Limit Password Reuse - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Limit Password Reuse - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Limit Password Reuse - Ensure authselect custom profile is used if authselect
      is present
    block:

    - name: Limit Password Reuse - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Limit Password Reuse - Informative message based on the authselect integrity
        check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Limit Password Reuse - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Limit Password Reuse - Define the current authselect profile as a local
        fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Limit Password Reuse - Define the new authselect custom profile as a local
        fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Limit Password Reuse - Get authselect current features to also enable
        them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Limit Password Reuse - Check if any custom profile with the same name
        was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Limit Password Reuse - Create an authselect custom profile based on the
        current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Limit Password Reuse - Create an authselect custom profile based on sssd
        profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Limit Password Reuse - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Limit Password Reuse - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Limit Password Reuse - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Limit Password Reuse - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Limit Password Reuse - Change the PAM file to be edited according to the
        custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Limit Password Reuse - Define a fact for control already filtered in case
      filters are used
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: Limit Password Reuse - Check if expected PAM module line is present in {{
      pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Limit Password Reuse - Include or update the PAM module line in {{ pam_file_path
      }}
    block:

    - name: Limit Password Reuse - Check if required PAM module line is present in
        {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Limit Password Reuse - Ensure the correct control for the required PAM
        module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Limit Password Reuse - Ensure the required PAM module line is included
        in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^password.*requisite.*pam_pwquality\.so
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Limit Password Reuse - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - |
    (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Limit Password Reuse - Check the presence of /etc/security/pwhistory.conf
    file
  ansible.builtin.stat:
    path: /etc/security/pwhistory.conf
  register: result_pwhistory_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Limit Password Reuse - pam_pwhistory.so parameters are configured in /etc/security/pwhistory.conf
    file
  block:

  - name: Limit Password Reuse - Ensure the pam_pwhistory.so remember parameter in
      /etc/security/pwhistory.conf
    ansible.builtin.lineinfile:
      path: /etc/security/pwhistory.conf
      regexp: ^\s*remember\s*=
      line: remember = {{ var_password_pam_unix_remember }}
      state: present

  - name: Limit Password Reuse - Ensure the pam_pwhistory.so remember parameter is
      removed from PAM files
    block:

    - name: Limit Password Reuse - Check if /etc/pam.d/system-auth file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_file_present

    - name: Limit Password Reuse - Check the proper remediation for the system
      block:

      - name: Limit Password Reuse - Define the PAM file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Limit Password Reuse - Check if system relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Limit Password Reuse - Ensure authselect custom profile is used if authselect
          is present
        block:

        - name: Limit Password Reuse - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Limit Password Reuse - Informative message based on the authselect
            integrity check result
          ansible.builtin.assert:
            that:
            - result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Limit Password Reuse - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Limit Password Reuse - Define the current authselect profile as a
            local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match("custom/")

        - name: Limit Password Reuse - Define the new authselect custom profile as
            a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match("custom/")

        - name: Limit Password Reuse - Get authselect current features to also enable
            them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: Limit Password Reuse - Check if any custom profile with the same name
            was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - authselect_current_profile is not match("custom/")

        - name: Limit Password Reuse - Create an authselect custom profile based on
            the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match("^(custom/|local)")
          - not result_authselect_custom_profile_present.stat.exists

        - name: Limit Password Reuse - Create an authselect custom profile based on
            sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_check_cmd is success
          - authselect_current_profile is match("local")
          - not result_authselect_custom_profile_present.stat.exists

        - name: Limit Password Reuse - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Limit Password Reuse - Ensure the authselect custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Limit Password Reuse - Restore the authselect features in the custom
            profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Limit Password Reuse - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Limit Password Reuse - Change the PAM file to be edited according
            to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
        when:
        - result_authselect_present.stat.exists

      - name: Limit Password Reuse - Define a fact for control already filtered in
          case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Limit Password Reuse - Ensure the "remember" option from "pam_pwhistory.so"
          is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal

      - name: Limit Password Reuse - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Limit Password Reuse - pam_pwhistory.so parameters are configured in PAM files
  block:

  - name: Limit Password Reuse - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Limit Password Reuse - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Limit Password Reuse - Ensure authselect custom profile is used if authselect
      is present
    block:

    - name: Limit Password Reuse - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Limit Password Reuse - Informative message based on the authselect integrity
        check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Limit Password Reuse - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Limit Password Reuse - Define the current authselect profile as a local
        fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Limit Password Reuse - Define the new authselect custom profile as a local
        fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Limit Password Reuse - Get authselect current features to also enable
        them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Limit Password Reuse - Check if any custom profile with the same name
        was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Limit Password Reuse - Create an authselect custom profile based on the
        current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Limit Password Reuse - Create an authselect custom profile based on sssd
        profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Limit Password Reuse - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Limit Password Reuse - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Limit Password Reuse - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Limit Password Reuse - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Limit Password Reuse - Change the PAM file to be edited according to the
        custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Limit Password Reuse - Define a fact for control already filtered in case
      filters are used
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: Limit Password Reuse - Check if expected PAM module line is present in {{
      pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Limit Password Reuse - Include or update the PAM module line in {{ pam_file_path
      }}
    block:

    - name: Limit Password Reuse - Check if required PAM module line is present in
        {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Limit Password Reuse - Ensure the correct control for the required PAM
        module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Limit Password Reuse - Ensure the required PAM module line is included
        in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Limit Password Reuse - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Limit Password Reuse - Define a fact for control already filtered in case
      filters are used
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: Limit Password Reuse - Check if the required PAM module option is present
      in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_unix_remember_option_present

  - name: Limit Password Reuse - Ensure the "remember" PAM option for "pam_pwhistory.so"
      is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
      line: \1 remember={{ var_password_pam_unix_remember }}
      state: present
    register: result_pam_accounts_password_pam_unix_remember_add
    when:
    - result_pam_module_accounts_password_pam_unix_remember_option_present.found ==
      0

  - name: Limit Password Reuse - Ensure the required value for "remember" PAM option
      from "pam_pwhistory.so" in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
      line: \1\2={{ var_password_pam_unix_remember }} \3
    register: result_pam_accounts_password_pam_unix_remember_edit
    when:
    - result_pam_module_accounts_password_pam_unix_remember_option_present.found &gt;
      0

  - name: Limit Password Reuse - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - (result_pam_remember_add is defined and result_pam_remember_add.changed) or
      (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - not result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_unix_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_unix_remember:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit" severity="medium">
                <xccdf-1.2:title>Account Lockouts Must Be Logged</xccdf-1.2:title>
                <xccdf-1.2:description>PAM faillock locks an account due to excessive password failures, this event must be logged.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003022</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271841r1092235_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Without auditing of these events it may be harder or impossible to identify what an attacker did after an attack.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_audit">
if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*audit"
    line="audit"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\baudit\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\baudit\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*audit' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ audit/' "$pam_file"
        fi
    done
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_audit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Account Lockouts Must Be Logged - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Remediation where authselect tool is present
  block:

  - name: Account Lockouts Must Be Logged - Check integrity of authselect current
      profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Account Lockouts Must Be Logged - Informative message based on the authselect
      integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Account Lockouts Must Be Logged - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Account Lockouts Must Be Logged - Ensure "with-faillock" feature is enabled
      using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when: result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Remediation where authselect tool is not
    present
  block:

  - name: Account Lockouts Must Be Logged - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Account Lockouts Must Be Logged - Enable pam_faillock.so preauth editing
      PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Account Lockouts Must Be Logged - Enable pam_faillock.so authfail editing
      PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Account Lockouts Must Be Logged - Enable pam_faillock.so account section
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when: not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
    in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*audit
    line: audit
    state: present
  when: result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
    not in PAM files
  block:

  - name: Account Lockouts Must Be Logged - Check if /etc/pam.d/system-auth file is
      present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Account Lockouts Must Be Logged - Check the proper remediation for the system
    block:

    - name: Account Lockouts Must Be Logged - Define the PAM file to be edited as
        a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Account Lockouts Must Be Logged - Check if system relies on authselect
        tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Account Lockouts Must Be Logged - Ensure authselect custom profile is
        used if authselect is present
      block:

      - name: Account Lockouts Must Be Logged - Check integrity of authselect current
          profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Account Lockouts Must Be Logged - Informative message based on the authselect
          integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Account Lockouts Must Be Logged - Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Account Lockouts Must Be Logged - Define the current authselect profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Account Lockouts Must Be Logged - Define the new authselect custom profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Account Lockouts Must Be Logged - Get authselect current features to
          also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Check if any custom profile with the
          same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
          is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Restore the authselect features in
          the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
          to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Account Lockouts Must Be Logged - Define a fact for control already filtered
        in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Account Lockouts Must Be Logged - Ensure the "audit" option from "pam_faillock.so"
        is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\baudit\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Account Lockouts Must Be Logged - Check if /etc/pam.d/password-auth file
      is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Account Lockouts Must Be Logged - Check the proper remediation for the system
    block:

    - name: Account Lockouts Must Be Logged - Define the PAM file to be edited as
        a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Account Lockouts Must Be Logged - Check if system relies on authselect
        tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Account Lockouts Must Be Logged - Ensure authselect custom profile is
        used if authselect is present
      block:

      - name: Account Lockouts Must Be Logged - Check integrity of authselect current
          profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Account Lockouts Must Be Logged - Informative message based on the authselect
          integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Account Lockouts Must Be Logged - Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Account Lockouts Must Be Logged - Define the current authselect profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Account Lockouts Must Be Logged - Define the new authselect custom profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Account Lockouts Must Be Logged - Get authselect current features to
          also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Check if any custom profile with the
          same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
          based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
          is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Account Lockouts Must Be Logged - Restore the authselect features in
          the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
          to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Account Lockouts Must Be Logged - Define a fact for control already filtered
        in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Account Lockouts Must Be Logged - Ensure the "audit" option from "pam_faillock.so"
        is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\baudit\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when: result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
    in PAM files
  block:

  - name: Account Lockouts Must Be Logged - Check if pam_faillock.so audit parameter
      is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*audit
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_audit_parameter_is_present

  - name: Account Lockouts Must Be Logged - Ensure the inclusion of pam_faillock.so
      preauth audit parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 audit
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_audit_parameter_is_present.found == 0
  when: not result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003022
  - NIST-800-53-AC-7 (a)
  - accounts_passwords_pam_faillock_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_audit:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_audit_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" severity="medium">
                <xccdf-1.2:title>Lock Accounts After Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>This rule configures the system to lock out accounts after a number of incorrect login attempts
using <html:code>pam_faillock.so</html:code>.
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected.
Ensure that the file <html:code>/etc/security/faillock.conf</html:code> contains the following entry:
<html:code>deny = &lt;count&gt;</html:code>
Where count should be less than or equal to
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> and greater than 0.

In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.30.SEC-OL1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271839r1092229_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>By limiting the number of failed logon attempts, the risk of unauthorized system access via
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
the account.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_deny"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_deny='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*deny\s*="
    line="deny = $var_accounts_passwords_pam_faillock_deny"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(deny\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_deny"'|g' $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\bdeny\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\bdeny\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*deny' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ deny='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ deny='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*silent.*\)\('"deny"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_deny"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"deny"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_deny"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_deny" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect
    tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Remediation where authselect
    tool is present
  block:

  - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
      current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Lock Accounts After Failed Password Attempts - Informative message based
      on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Lock Accounts After Failed Password Attempts - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Lock Accounts After Failed Password Attempts - Ensure "with-faillock" feature
      is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

  - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
      is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so preauth
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so authfail
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so account
      section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_deny # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_deny: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>
  tags:
    - always

- name: Lock Accounts After Failed Password Attempts - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*deny\s*=
    line: deny = {{ var_accounts_passwords_pam_faillock_deny }}
    state: present
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter not in PAM files
  block:

  - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Lock Accounts After Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Lock Accounts After Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Lock Accounts After Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Lock Accounts After Failed Password Attempts - Informative message based
          on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Lock Accounts After Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Check if any custom profile
          with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Lock Accounts After Failed Password Attempts - Change the PAM file to
          be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option
        from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Lock Accounts After Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Lock Accounts After Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Lock Accounts After Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Lock Accounts After Failed Password Attempts - Informative message based
          on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Lock Accounts After Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Check if any custom profile
          with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Lock Accounts After Failed Password Attempts - Change the PAM file to
          be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option
        from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter in PAM files
  block:

  - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
      deny parameter is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*deny
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_deny_parameter_is_present

  - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so
      preauth deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found == 0

  - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so
      authfail deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found == 0

  - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
      for pam_faillock.so preauth deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(deny)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found &gt; 0

  - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
      for pam_faillock.so authfail deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(deny)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found &gt; 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-003020
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" severity="medium">
                <xccdf-1.2:title>Configure the root Account for Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>This rule configures the system to lock out the <html:code>root</html:code> account after a number of
incorrect login attempts using <html:code>pam_faillock.so</html:code>.

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003021</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271840r1092232_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>By limiting the number of failed logon attempts, the risk of unauthorized system access via
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
the account.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_deny_root"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*even_deny_root"
    line="even_deny_root"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\beven_deny_root\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\beven_deny_root\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*even_deny_root' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ even_deny_root/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ even_deny_root/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_deny_root" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Check if system
    relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Remediation where
    authselect tool is present
  block:

  - name: Configure the root Account for Failed Password Attempts - Check integrity
      of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Configure the root Account for Failed Password Attempts - Informative message
      based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Configure the root Account for Failed Password Attempts - Get authselect
      current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Configure the root Account for Failed Password Attempts - Ensure "with-faillock"
      feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Configure the root Account for Failed Password Attempts - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Remediation where
    authselect tool is not present
  block:

  - name: Configure the root Account for Failed Password Attempts - Check if pam_faillock.so
      is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
      preauth editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
      authfail editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
      account section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Check the presence
    of /etc/security/faillock.conf file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
    even_deny_root parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*even_deny_root
    line: even_deny_root
    state: present
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
    even_deny_root parameter not in PAM files
  block:

  - name: Configure the root Account for Failed Password Attempts - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Configure the root Account for Failed Password Attempts - Check the proper
      remediation for the system
    block:

    - name: Configure the root Account for Failed Password Attempts - Define the PAM
        file to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Configure the root Account for Failed Password Attempts - Check if system
        relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Configure the root Account for Failed Password Attempts - Ensure authselect
        custom profile is used if authselect is present
      block:

      - name: Configure the root Account for Failed Password Attempts - Check integrity
          of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Configure the root Account for Failed Password Attempts - Informative
          message based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Configure the root Account for Failed Password Attempts - Get authselect
          current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Configure the root Account for Failed Password Attempts - Define the
          current authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Define the
          new authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Get authselect
          current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Check if any
          custom profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Create an
          authselect custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Create an
          authselect custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Configure the root Account for Failed Password Attempts - Ensure the
          authselect custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Configure the root Account for Failed Password Attempts - Restore the
          authselect features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Configure the root Account for Failed Password Attempts - Change the
          PAM file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Configure the root Account for Failed Password Attempts - Define a fact
        for control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Configure the root Account for Failed Password Attempts - Ensure the "even_deny_root"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\beven_deny_root\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Configure the root Account for Failed Password Attempts - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Configure the root Account for Failed Password Attempts - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Configure the root Account for Failed Password Attempts - Check the proper
      remediation for the system
    block:

    - name: Configure the root Account for Failed Password Attempts - Define the PAM
        file to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Configure the root Account for Failed Password Attempts - Check if system
        relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Configure the root Account for Failed Password Attempts - Ensure authselect
        custom profile is used if authselect is present
      block:

      - name: Configure the root Account for Failed Password Attempts - Check integrity
          of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Configure the root Account for Failed Password Attempts - Informative
          message based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Configure the root Account for Failed Password Attempts - Get authselect
          current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Configure the root Account for Failed Password Attempts - Define the
          current authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Define the
          new authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Get authselect
          current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Check if any
          custom profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Configure the root Account for Failed Password Attempts - Create an
          authselect custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Create an
          authselect custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Configure the root Account for Failed Password Attempts - Ensure the
          authselect custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Configure the root Account for Failed Password Attempts - Restore the
          authselect features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Configure the root Account for Failed Password Attempts - Change the
          PAM file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Configure the root Account for Failed Password Attempts - Define a fact
        for control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Configure the root Account for Failed Password Attempts - Ensure the "even_deny_root"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\beven_deny_root\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Configure the root Account for Failed Password Attempts - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
    even_deny_root parameter in PAM files
  block:

  - name: Configure the root Account for Failed Password Attempts - Check if pam_faillock.so
      even_deny_root parameter is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*even_deny_root
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_even_deny_root_parameter_is_present

  - name: Configure the root Account for Failed Password Attempts - Ensure the inclusion
      of pam_faillock.so preauth even_deny_root parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 even_deny_root
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_even_deny_root_parameter_is_present.found == 0

  - name: Configure the root Account for Failed Password Attempts - Ensure the inclusion
      of pam_faillock.so authfail even_deny_root parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 even_deny_root
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_even_deny_root_parameter_is_present.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003021
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(c)
  - accounts_passwords_pam_faillock_deny_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir" severity="medium">
                <xccdf-1.2:title>Lock Accounts Must Persist</xccdf-1.2:title>
                <xccdf-1.2:description>This rule ensures that the system lock out accounts using <html:code>pam_faillock.so</html:code> persist
after system reboot. From "pam_faillock" man pages:
<html:pre>Note that the default directory that "pam_faillock" uses is usually cleared on system
boot so the access will be reenabled after system reboot. If that is undesirable, a different
tally directory must be set with the "dir" option.</html:pre>

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.

The chosen profile expects the directory to be <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7.1(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003023</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271842r1092238_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Locking out user accounts after a number of incorrect attempts prevents direct password
guessing attacks. In combination with the <html:code>silent</html:code> option, user enumeration attacks
are also mitigated.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_dir" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_dir='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*dir\s*="
    line="dir = $var_accounts_passwords_pam_faillock_dir"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(dir\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_dir"'|g' $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\bdir\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\bdir\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*dir' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ dir='"$var_accounts_passwords_pam_faillock_dir"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ dir='"$var_accounts_passwords_pam_faillock_dir"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*silent.*\)\('"dir"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_dir"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"dir"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_dir"'\3/' "$pam_file"
        fi
    done
fi

if ! rpm -q --quiet "python3-libselinux" ; then
    yum install -y "python3-libselinux"
fi
if ! rpm -q --quiet "python3-policycoreutils" ; then
    yum install -y "python3-policycoreutils"
fi
if ! rpm -q --quiet "policycoreutils-python-utils" ; then
    yum install -y "policycoreutils-python-utils"
fi

mkdir -p "$var_accounts_passwords_pam_faillock_dir"
semanage fcontext -a -t faillog_t "$var_accounts_passwords_pam_faillock_dir(/.*)?"
restorecon -R -v "$var_accounts_passwords_pam_faillock_dir"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_dir" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Remediation where authselect tool is present
  block:

  - name: Lock Accounts Must Persist - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Lock Accounts Must Persist - Informative message based on the authselect
      integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Lock Accounts Must Persist - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Lock Accounts Must Persist - Ensure "with-faillock" feature is enabled using
      authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Lock Accounts Must Persist - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Remediation where authselect tool is not present
  block:

  - name: Lock Accounts Must Persist - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Lock Accounts Must Persist - Enable pam_faillock.so preauth editing PAM
      files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Lock Accounts Must Persist - Enable pam_faillock.so authfail editing PAM
      files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Lock Accounts Must Persist - Enable pam_faillock.so account section editing
      PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_accounts_passwords_pam_faillock_dir # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_dir: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>
  tags:
    - always

- name: Lock Accounts Must Persist - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Ensure the pam_faillock.so dir parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*dir\s*=
    line: dir = {{ var_accounts_passwords_pam_faillock_dir }}
    state: present
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Ensure the pam_faillock.so dir parameter not
    in PAM files
  block:

  - name: Lock Accounts Must Persist - Check if /etc/pam.d/system-auth file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Lock Accounts Must Persist - Check the proper remediation for the system
    block:

    - name: Lock Accounts Must Persist - Define the PAM file to be edited as a local
        fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Lock Accounts Must Persist - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Lock Accounts Must Persist - Ensure authselect custom profile is used
        if authselect is present
      block:

      - name: Lock Accounts Must Persist - Check integrity of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Lock Accounts Must Persist - Informative message based on the authselect
          integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Lock Accounts Must Persist - Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Lock Accounts Must Persist - Define the current authselect profile as
          a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Lock Accounts Must Persist - Define the new authselect custom profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Lock Accounts Must Persist - Get authselect current features to also
          enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts Must Persist - Check if any custom profile with the same
          name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts Must Persist - Create an authselect custom profile based
          on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts Must Persist - Create an authselect custom profile based
          on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts Must Persist - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts Must Persist - Ensure the authselect custom profile is
          selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts Must Persist - Restore the authselect features in the
          custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Lock Accounts Must Persist - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Lock Accounts Must Persist - Change the PAM file to be edited according
          to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Lock Accounts Must Persist - Define a fact for control already filtered
        in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Lock Accounts Must Persist - Ensure the "dir" option from "pam_faillock.so"
        is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bdir\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Lock Accounts Must Persist - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Lock Accounts Must Persist - Check if /etc/pam.d/password-auth file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Lock Accounts Must Persist - Check the proper remediation for the system
    block:

    - name: Lock Accounts Must Persist - Define the PAM file to be edited as a local
        fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Lock Accounts Must Persist - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Lock Accounts Must Persist - Ensure authselect custom profile is used
        if authselect is present
      block:

      - name: Lock Accounts Must Persist - Check integrity of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Lock Accounts Must Persist - Informative message based on the authselect
          integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Lock Accounts Must Persist - Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Lock Accounts Must Persist - Define the current authselect profile as
          a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Lock Accounts Must Persist - Define the new authselect custom profile
          as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Lock Accounts Must Persist - Get authselect current features to also
          enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts Must Persist - Check if any custom profile with the same
          name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts Must Persist - Create an authselect custom profile based
          on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts Must Persist - Create an authselect custom profile based
          on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts Must Persist - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts Must Persist - Ensure the authselect custom profile is
          selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts Must Persist - Restore the authselect features in the
          custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Lock Accounts Must Persist - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Lock Accounts Must Persist - Change the PAM file to be edited according
          to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Lock Accounts Must Persist - Define a fact for control already filtered
        in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Lock Accounts Must Persist - Ensure the "dir" option from "pam_faillock.so"
        is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bdir\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Lock Accounts Must Persist - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Ensure the pam_faillock.so dir parameter in PAM
    files
  block:

  - name: Lock Accounts Must Persist - Check if pam_faillock.so dir parameter is already
      enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*dir
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_dir_parameter_is_present

  - name: Lock Accounts Must Persist - Ensure the inclusion of pam_faillock.so preauth
      dir parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 dir={{ var_accounts_passwords_pam_faillock_dir }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_dir_parameter_is_present.found == 0

  - name: Lock Accounts Must Persist - Ensure the inclusion of pam_faillock.so authfail
      dir parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 dir={{ var_accounts_passwords_pam_faillock_dir }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_dir_parameter_is_present.found == 0

  - name: Lock Accounts Must Persist - Ensure the desired value for pam_faillock.so
      preauth dir parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(dir)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_dir }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_dir_parameter_is_present.found &gt; 0

  - name: Lock Accounts Must Persist - Ensure the desired value for pam_faillock.so
      authfail dir parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(dir)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_dir }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_dir_parameter_is_present.found &gt; 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Ensure necessary SELinux packages are installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - python3-libselinux
  - python3-policycoreutils
  - policycoreutils-python-utils
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Create the tally directory if it does not exist
  ansible.builtin.file:
    path: '{{ var_accounts_passwords_pam_faillock_dir }}'
    state: directory
    setype: faillog_t
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Ensure SELinux file context is permanently set
  ansible.builtin.command:
    cmd: semanage fcontext -a -t faillog_t "{{ var_accounts_passwords_pam_faillock_dir
      }}(/.*)?"
  register: result_accounts_passwords_pam_faillock_dir_semanage
  failed_when: false
  changed_when:
  - result_accounts_passwords_pam_faillock_dir_semanage.rc == 0
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Lock Accounts Must Persist - Ensure SELinux file context is applied
  ansible.builtin.command:
    cmd: restorecon -R "{{ var_accounts_passwords_pam_faillock_dir }}"
  register: result_accounts_passwords_pam_faillock_dir_restorecon
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003023
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AC-7(b)
  - NIST-800-53-AC-7.1(ii)
  - accounts_passwords_pam_faillock_dir
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_dir:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_dir_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" severity="medium">
                <xccdf-1.2:title>Set Interval For Counting Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>Utilizing <html:code>pam_faillock.so</html:code>, the <html:code>fail_interval</html:code> directive configures the system
to lock out an account after a number of incorrect login attempts within a specified time
period.

Ensure that the file <html:code>/etc/security/faillock.conf</html:code> contains the following entry:
<html:code>fail_interval = &lt;interval-in-seconds&gt;</html:code> where <html:code>interval-in-seconds</html:code> is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:code> or greater.


In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002416</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271754r1091974_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_interval"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_fail_interval='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*fail_interval\s*="
    line="fail_interval = $var_accounts_passwords_pam_faillock_fail_interval"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(fail_interval\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_fail_interval"'|g' $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\bfail_interval\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\bfail_interval\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*fail_interval' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ fail_interval='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ fail_interval='"$var_accounts_passwords_pam_faillock_fail_interval"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*silent.*\)\('"fail_interval"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"fail_interval"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_fail_interval"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_interval" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Check if system relies
    on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Remediation where authselect
    tool is present
  block:

  - name: Set Interval For Counting Failed Password Attempts - Check integrity of
      authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Set Interval For Counting Failed Password Attempts - Informative message
      based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Set Interval For Counting Failed Password Attempts - Get authselect current
      features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Set Interval For Counting Failed Password Attempts - Ensure "with-faillock"
      feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Set Interval For Counting Failed Password Attempts - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

  - name: Set Interval For Counting Failed Password Attempts - Check if pam_faillock.so
      is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
      preauth editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
      authfail editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
      account section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_fail_interval # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_fail_interval: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/>
  tags:
    - always

- name: Set Interval For Counting Failed Password Attempts - Check the presence of
    /etc/security/faillock.conf file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
    fail_interval parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*fail_interval\s*=
    line: fail_interval = {{ var_accounts_passwords_pam_faillock_fail_interval }}
    state: present
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
    fail_interval parameter not in PAM files
  block:

  - name: Set Interval For Counting Failed Password Attempts - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Set Interval For Counting Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Set Interval For Counting Failed Password Attempts - Define the PAM file
        to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Set Interval For Counting Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
        custom profile is used if authselect is present
      block:

      - name: Set Interval For Counting Failed Password Attempts - Check integrity
          of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Set Interval For Counting Failed Password Attempts - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set Interval For Counting Failed Password Attempts - Get authselect
          current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set Interval For Counting Failed Password Attempts - Define the current
          authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Define the new
          authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Get authselect
          current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Interval For Counting Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Interval For Counting Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set Interval For Counting Failed Password Attempts - Change the PAM
          file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Set Interval For Counting Failed Password Attempts - Define a fact for
        control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Set Interval For Counting Failed Password Attempts - Ensure the "fail_interval"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bfail_interval\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Set Interval For Counting Failed Password Attempts - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Set Interval For Counting Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Set Interval For Counting Failed Password Attempts - Define the PAM file
        to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Set Interval For Counting Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
        custom profile is used if authselect is present
      block:

      - name: Set Interval For Counting Failed Password Attempts - Check integrity
          of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Set Interval For Counting Failed Password Attempts - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set Interval For Counting Failed Password Attempts - Get authselect
          current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set Interval For Counting Failed Password Attempts - Define the current
          authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Define the new
          authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Get authselect
          current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Interval For Counting Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Interval For Counting Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set Interval For Counting Failed Password Attempts - Change the PAM
          file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Set Interval For Counting Failed Password Attempts - Define a fact for
        control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Set Interval For Counting Failed Password Attempts - Ensure the "fail_interval"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bfail_interval\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
    fail_interval parameter in PAM files
  block:

  - name: Set Interval For Counting Failed Password Attempts - Check if pam_faillock.so
      fail_interval parameter is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*fail_interval
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_fail_interval_parameter_is_present

  - name: Set Interval For Counting Failed Password Attempts - Ensure the inclusion
      of pam_faillock.so preauth fail_interval parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
        }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_fail_interval_parameter_is_present.found == 0

  - name: Set Interval For Counting Failed Password Attempts - Ensure the inclusion
      of pam_faillock.so authfail fail_interval parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
        }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_fail_interval_parameter_is_present.found == 0

  - name: Set Interval For Counting Failed Password Attempts - Ensure the desired
      value for pam_faillock.so preauth fail_interval parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(fail_interval)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_fail_interval }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_fail_interval_parameter_is_present.found &gt; 0

  - name: Set Interval For Counting Failed Password Attempts - Ensure the desired
      value for pam_faillock.so authfail fail_interval parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(fail_interval)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_fail_interval }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_fail_interval_parameter_is_present.found &gt; 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - DISA-STIG-OL09-00-002416
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - accounts_passwords_pam_faillock_interval
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_interval:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" severity="medium">
                <xccdf-1.2:title>Set Lockout Time for Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description>This rule configures the system to lock out accounts during a specified time period after a
number of incorrect login attempts using <html:code>pam_faillock.so</html:code>.

Ensure that the file <html:code>/etc/security/faillock.conf</html:code> contains the following entry:
<html:code>unlock_time=&lt;interval-in-seconds&gt;</html:code> where
<html:code>interval-in-seconds</html:code> is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/></html:code> or greater.

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid any errors when manually editing these files,
it is recommended to use the appropriate tools, such as <html:code>authselect</html:code> or <html:code>authconfig</html:code>,
depending on the OS version.

If <html:code>unlock_time</html:code> is set to <html:code>0</html:code>, manual intervention by an administrator is required
to unlock a user. This should be done using the <html:code>faillock</html:code> tool.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system supports the new <html:code>/etc/security/faillock.conf</html:code> file but the
pam_faillock.so parameters are defined directly in <html:code>/etc/pam.d/system-auth</html:code> and
<html:code>/etc/pam.d/password-auth</html:code>, the remediation will migrate the <html:code>unlock_time</html:code> parameter
to <html:code>/etc/security/faillock.conf</html:code> to ensure compatibility with <html:code>authselect</html:code> tool.
The parameters <html:code>deny</html:code> and <html:code>fail_interval</html:code>, if used, also have to be migrated
by their respective remediation.</xccdf-1.2:warning>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code>/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code>faillock.conf</html:code> file.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.30.SEC-OL1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002417</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271755r1091977_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_passwords_pam_faillock_unlock_time"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_passwords_pam_faillock_unlock_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*unlock_time\s*="
    line="unlock_time = $var_accounts_passwords_pam_faillock_unlock_time"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(unlock_time\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_unlock_time"'|g' $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\bunlock_time\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\bunlock_time\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so (preauth|authfail).*unlock_time' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*silent.*/ s/$/ unlock_time='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ unlock_time='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*silent.*\)\('"unlock_time"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"unlock_time"'=\)[0-9]\+\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_passwords_pam_faillock_unlock_time" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Check if system relies on
    authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
    tool is present
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
      current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Set Lockout Time for Failed Password Attempts - Informative message based
      on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Set Lockout Time for Failed Password Attempts - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Set Lockout Time for Failed Password Attempts - Ensure "with-faillock" feature
      is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
      is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so preauth
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so authfail
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so account
      section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_unlock_time # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_unlock_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>
  tags:
    - always

- name: Set Lockout Time for Failed Password Attempts - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*unlock_time\s*=
    line: unlock_time = {{ var_accounts_passwords_pam_faillock_unlock_time }}
    state: present
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter not in PAM files
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Set Lockout Time for Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Set Lockout Time for Failed Password Attempts - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set Lockout Time for Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Change the PAM file
          to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Set Lockout Time for Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        failed_when: false

      - name: Set Lockout Time for Failed Password Attempts - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set Lockout Time for Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Change the PAM file
          to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
      when:
      - result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter in PAM files
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
      unlock_time parameter is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*unlock_time
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_unlock_time_parameter_is_present

  - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
      pam_faillock.so preauth unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
        }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
      pam_faillock.so authfail unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
        }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
      for pam_faillock.so preauth unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(unlock_time)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0

  - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
      for pam_faillock.so authfail unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(unlock_time)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0
  when:
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-002417
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality">
              <xccdf-1.2:title>Set Password Quality Requirements</xccdf-1.2:title>
              <xccdf-1.2:description>The default <html:code>pam_pwquality</html:code> PAM module provides strength
checking for passwords. It performs a number of checks, such as
making sure passwords are not similar to dictionary words, are of
at least a certain length, are not the previous password reversed,
and are not simply a change of case from the previous password. It
can also require passwords to be in certain character classes. The
<html:code>pam_pwquality</html:code> module is the preferred way of configuring
password requirements.
<html:br/>
        <html:br/>
The man pages <html:code>pam_pwquality(8)</html:code>
provide information on the capabilities and configuration of
each.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality_pwquality">
                <xccdf-1.2:title>Set Password Quality Requirements with pam_pwquality</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>pam_pwquality</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br/>
         <html:br/>
For example, to configure <html:code>pam_pwquality</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, make sure that <html:code>pam_pwquality</html:code> exists in <html:code>/etc/pam.d/system-auth</html:code>:
<html:pre>password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</html:pre>
If no such line exists, add one as the first line of the password section in <html:code>/etc/pam.d/system-auth</html:code>.
Next, modify the settings in <html:code>/etc/security/pwquality.conf</html:code> to match the following:
<html:pre>difok = 4
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3</html:pre>
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</xccdf-1.2:description>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" type="number">
                  <xccdf-1.2:title>dcredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of digits in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" type="number">
                  <xccdf-1.2:title>dictcheck</xccdf-1.2:title>
                  <xccdf-1.2:description>Prevent the use of dictionary words for passwords.</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value>1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_difok" type="number">
                  <xccdf-1.2:title>difok</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of characters not present in old
password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                  <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                  <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                  <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                  <xccdf-1.2:value>8</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" type="number">
                  <xccdf-1.2:title>lcredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of lower case in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" type="number">
                  <xccdf-1.2:title>maxclassrepeat</xccdf-1.2:title>
                  <xccdf-1.2:description>Maximum Number of Consecutive Repeating Characters in a Password From the Same Character Class</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value>4</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" type="number">
                  <xccdf-1.2:title>maxrepeat</xccdf-1.2:title>
                  <xccdf-1.2:description>Maximum Number of Consecutive Repeating Characters in a Password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_minclass" type="number">
                  <xccdf-1.2:title>minclass</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of categories of characters that must exist in a password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_minlen" type="number">
                  <xccdf-1.2:title>minlen</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of characters in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                  <xccdf-1.2:value selector="12">12</xccdf-1.2:value>
                  <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                  <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                  <xccdf-1.2:value selector="17">17</xccdf-1.2:value>
                  <xccdf-1.2:value selector="18">18</xccdf-1.2:value>
                  <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
                  <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                  <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                  <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                  <xccdf-1.2:value>15</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" type="number">
                  <xccdf-1.2:title>ocredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of other (special characters) in
password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_retry" type="number">
                  <xccdf-1.2:title>retry</xccdf-1.2:title>
                  <xccdf-1.2:description>Number of retry attempts before erroring out</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" type="number">
                  <xccdf-1.2:title>ucredit</xccdf-1.2:title>
                  <xccdf-1.2:description>Minimum number of upper case in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>dcredit</html:code> parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each digit. Modify the <html:code>dcredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of a digit in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001020</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271616r1091560_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_dcredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_dcredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bdcredit\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bdcredit\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^dcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_dcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^dcredit\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^dcredit\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_dcredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001020
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_dcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_dcredit # promote to variable
  set_fact:
    var_password_pam_dcredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Check
    if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001020
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_dcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Check
    the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Define
      the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Check
      if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Ensure
      authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters -
        Change the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Define
      a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Ensure
      the "dcredit" option from "pam_pwquality.so" is not present in {{ pam_file_path
      }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bdcredit\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Ensure
      authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001020
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_dcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Ensure
    PAM variable dcredit is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dcredit
    line: dcredit = {{ var_password_pam_dcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001020
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_dcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_dcredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>dictcheck</html:code> check if passwords contains dictionary words. When
<html:code>dictcheck</html:code> is set to <html:code>1</html:code> passwords will be checked for dictionary words.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00225</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001125</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271637r1091623_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
<html:br/>
          <html:br/>
Passwords with dictionary words may be more vulnerable to password-guessing attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_dictcheck" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_dictcheck='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bdictcheck\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bdictcheck\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^dictcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_dictcheck"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^dictcheck\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^dictcheck\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_dictcheck" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001125
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_dictcheck
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_dictcheck # promote to variable
  set_fact:
    var_password_pam_dictcheck: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
    Words - Check if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001125
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_dictcheck
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
    Words - Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Ensure authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Get authselect current features to also enable them in the custom
        profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
        Words - Change the PAM file to be edited according to the custom authselect
        profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Define a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Ensure the "dictcheck" option from "pam_pwquality.so" is not present
      in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bdictcheck\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001125
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_dictcheck
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
    Words - Ensure PAM variable dictcheck is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dictcheck
    line: dictcheck = {{ var_password_pam_dictcheck }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001125
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_dictcheck
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_dictcheck:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_dictcheck:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_dictcheck_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>difok</html:code> parameter sets the number of characters
in a password that must not be present in and old password during a password change.
<html:br/>
          <html:br/>
Modify the <html:code>difok</html:code> setting in <html:code>/etc/security/pwquality.conf</html:code>
to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/> to require differing characters
when changing passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001025</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271617r1091563_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources
required to compromise the password. Password complexity, or strength,
is a measure of the effectiveness of a password in resisting attempts
at guessing and brute–force attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long
it takes to crack a password. The more complex the password, the
greater the number of possible combinations that need to be tested
before the password is compromised.
<html:br/>
          <html:br/>
Requiring a minimum number of different characters during password changes ensures that
newly changed passwords should not resemble previously compromised ones.
Note that passwords which are changed on compromised systems will still be compromised, however.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_difok" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_difok='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bdifok\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bdifok\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^difok")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_difok"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^difok\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^difok\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_difok" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - DISA-STIG-OL09-00-001025
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(b)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_difok
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_difok # promote to variable
  set_fact:
    var_password_pam_difok: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Different Characters -
    Check if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - DISA-STIG-OL09-00-001025
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(b)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_difok
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Different Characters -
    Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Ensure authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
        - Change the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Define a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Ensure the "difok" option from "pam_pwquality.so" is not present in {{ pam_file_path
      }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bdifok\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - DISA-STIG-OL09-00-001025
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(b)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_difok
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Different Characters -
    Ensure PAM variable difok is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*difok
    line: difok = {{ var_password_pam_difok }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - DISA-STIG-OL09-00-001025
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(b)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_difok
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_difok:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_difok"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_difok:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Enforce for root User</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>enforce_for_root</html:code> parameter controls requirements for
enforcing password complexity for the root user. Enable the <html:code>enforce_for_root</html:code>
setting in <html:code>/etc/security/pwquality.conf</html:code> to require the <html:code>root</html:code> user
to use complex passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000266-GPOS-00101</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00225</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001045</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271621r1091575_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise
the password. Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a
password. The more complex the password, the greater the number of possible combinations
that need to be tested before the password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_enforce_root" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/security/pwquality.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*enforce_for_root/Id" "/etc/security/pwquality.conf"
else
    touch "/etc/security/pwquality.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/security/pwquality.conf"

cp "/etc/security/pwquality.conf" "/etc/security/pwquality.conf.bak"
# Insert at the end of the file
printf '%s\n' "enforce_for_root" &gt;&gt; "/etc/security/pwquality.conf"
# Clean up after ourselves.
rm "/etc/security/pwquality.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_enforce_root" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001045
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_enforce_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Enforce for root User
  lineinfile:
    path: /etc/security/pwquality.conf
    create: true
    regexp: ''
    line: enforce_for_root
    state: present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001045
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_enforce_root
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_enforce_root:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_enforce_root_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>lcredit</html:code> parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each lowercase character. Modify the <html:code>lcredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of a lowercase character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001015</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271615r1091557_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possble combinations that need to be tested before the password is compromised.
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_lcredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_lcredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\blcredit\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\blcredit\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^lcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_lcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^lcredit\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^lcredit\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_lcredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001015
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_lcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_lcredit # promote to variable
  set_fact:
    var_password_pam_lcredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters -
    Check if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001015
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_lcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters -
    Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Ensure authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
        - Change the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Define a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Ensure the "lcredit" option from "pam_pwquality.so" is not present in {{ pam_file_path
      }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\blcredit\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001015
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_lcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters -
    Ensure PAM variable lcredit is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*lcredit
    line: lcredit = {{ var_password_pam_lcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001015
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_lcredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_lcredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>maxclassrepeat</html:code> parameter controls requirements for
consecutive repeating characters from the same character class. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters from the same character class. Modify the
<html:code>maxclassrepeat</html:code> setting in <html:code>/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>
to prevent a run of (<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/> + 1) or more identical characters.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000730-GPOS-00190</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001030</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271618r1091566_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting
attempts at guessing and brute-force attacks.
<html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex a password, the greater the number of possible combinations that need to be tested before the
password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_maxclassrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_maxclassrepeat='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bmaxclassrepeat\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bmaxclassrepeat\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^maxclassrepeat")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_maxclassrepeat"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^maxclassrepeat\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^maxclassrepeat\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_maxclassrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxclassrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_maxclassrepeat # promote to variable
  set_fact:
    var_password_pam_maxclassrepeat: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
    Characters from Same Character Class - Check if /etc/pam.d/system-auth file is
    present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxclassrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
    Characters from Same Character Class - Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Define the PAM file to be edited as a
      local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Check if system relies on authselect
      tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Ensure authselect custom profile is used
      if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Check integrity of authselect current
        profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Informative message based on the authselect
        integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Define the current authselect profile
        as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Define the new authselect custom profile
        as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Get authselect current features to
        also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Check if any custom profile with the
        same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Create an authselect custom profile
        based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Create an authselect custom profile
        based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Ensure the authselect custom profile
        is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Restore the authselect features in
        the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
        Characters from Same Character Class - Change the PAM file to be edited according
        to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Define a fact for control already filtered
      in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Ensure the "maxclassrepeat" option from
      "pam_pwquality.so" is not present in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bmaxclassrepeat\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxclassrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
    Characters from Same Character Class - Ensure PAM variable maxclassrepeat is set
    accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*maxclassrepeat
    line: maxclassrepeat = {{ var_password_pam_maxclassrepeat }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxclassrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_maxclassrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_maxclassrepeat:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" severity="medium">
                  <xccdf-1.2:title>Set Password Maximum Consecutive Repeating Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>maxrepeat</html:code> parameter controls requirements for
consecutive repeating characters. When set to a positive number, it will reject passwords
which contain more than that number of consecutive characters. Modify the <html:code>maxrepeat</html:code> setting
in <html:code>/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/> to prevent a
run of (<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/> + 1) or more identical characters.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001035</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271619r1091569_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
guessing and brute-force attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before the
password is compromised.
<html:br/>
          <html:br/>
Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_maxrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_maxrepeat='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bmaxrepeat\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bmaxrepeat\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^maxrepeat")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_maxrepeat"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^maxrepeat\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^maxrepeat\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_maxrepeat" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001035
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_maxrepeat # promote to variable
  set_fact:
    var_password_pam_maxrepeat: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" use="legacy"/>
  tags:
    - always

- name: Set Password Maximum Consecutive Repeating Characters - Check if /etc/pam.d/system-auth
    file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001035
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Password Maximum Consecutive Repeating Characters - Check the proper remediation
    for the system
  block:

  - name: Set Password Maximum Consecutive Repeating Characters - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Set Password Maximum Consecutive Repeating Characters - Check if system
      relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set Password Maximum Consecutive Repeating Characters - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set Password Maximum Consecutive Repeating Characters - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set Password Maximum Consecutive Repeating Characters - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set Password Maximum Consecutive Repeating Characters - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set Password Maximum Consecutive Repeating Characters - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set Password Maximum Consecutive Repeating Characters - Define the new
        authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set Password Maximum Consecutive Repeating Characters - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set Password Maximum Consecutive Repeating Characters - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set Password Maximum Consecutive Repeating Characters - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set Password Maximum Consecutive Repeating Characters - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set Password Maximum Consecutive Repeating Characters - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set Password Maximum Consecutive Repeating Characters - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set Password Maximum Consecutive Repeating Characters - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set Password Maximum Consecutive Repeating Characters - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set Password Maximum Consecutive Repeating Characters - Change the PAM
        file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set Password Maximum Consecutive Repeating Characters - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Set Password Maximum Consecutive Repeating Characters - Ensure the "maxrepeat"
      option from "pam_pwquality.so" is not present in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bmaxrepeat\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Set Password Maximum Consecutive Repeating Characters - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001035
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Password Maximum Consecutive Repeating Characters - Ensure PAM variable
    maxrepeat is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*maxrepeat
    line: maxrepeat = {{ var_password_pam_maxrepeat }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001035
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_maxrepeat
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_maxrepeat:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_maxrepeat:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>minclass</html:code> parameter controls
requirements for usage of different character classes, or types, of character
that must exist in a password before it is considered valid. For example,
setting this value to three (3) requires that any password must have characters
from at least three different categories in order to be approved. The default
value is zero (0), meaning there are no required classes. There are four
categories available:
<html:pre>
* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)
</html:pre>
Modify the <html:code>minclass</html:code> setting in <html:code>/etc/security/pwquality.conf</html:code> entry
to require <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
differing categories of characters when changing passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001040</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271620r1091572_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.
<html:br/>
          <html:br/>
Requiring a minimum number of character categories makes password guessing attacks more difficult
by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_minclass" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_minclass='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bminclass\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bminclass\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minclass")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minclass"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minclass\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^minclass\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_minclass" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001040
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_minclass
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_minclass # promote to variable
  set_fact:
    var_password_pam_minclass: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories -
    Check if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001040
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_minclass
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories -
    Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Ensure authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
        - Change the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Define a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Ensure the "minclass" option from "pam_pwquality.so" is not present in {{
      pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bminclass\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001040
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_minclass
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories -
    Ensure PAM variable minclass is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minclass
    line: minclass = {{ var_password_pam_minclass }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001040
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_minclass
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_minclass:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minclass"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_minclass:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Length</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>minlen</html:code> parameter controls requirements for
minimum characters required in a password. Add <html:code>minlen=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
          </html:code>
after pam_pwquality to set minimum password length requirements.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
<html:br/>
Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength
and how long it takes to crack a password. Use of more characters in a password
helps to exponentially increase the time and/or resources required to
compromise the password.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_minlen" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_minlen='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bminlen\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bminlen\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minlen")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minlen"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minlen\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^minlen\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_minlen" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_minlen
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Length - Check if /etc/pam.d/system-auth
    file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_minlen
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Length - Check the proper
    remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Define the
      PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Check if system
      relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Informative
        message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Define the
        current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Define the
        new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Check if
        any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Create an
        authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Create an
        authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure the
        authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Restore the
        authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Change the
        PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Define a fact
      for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure the
      "minlen" option from "pam_pwquality.so" is not present in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bminlen\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_minlen
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM variable
    minlen is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minlen
    line: minlen = {{ var_password_pam_minlen }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_minlen
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_minlen:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>ocredit=</html:code> parameter controls requirements for
usage of special (or "other") characters in a password. When set to a negative number,
any password will be required to contain that many special characters.
When set to a positive number, pam_pwquality will grant +1
additional length credit for each special character. Modify the <html:code>ocredit</html:code> setting
in <html:code>/etc/security/pwquality.conf</html:code> to equal <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>
to require use of a special character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000266-GPOS-00101</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001120</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271636r1091620_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring a minimum number of special characters makes password guessing attacks
more difficult by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_ocredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_ocredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bocredit\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bocredit\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ocredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ocredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ocredit\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^ocredit\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_ocredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001120
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_ocredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_ocredit # promote to variable
  set_fact:
    var_password_pam_ocredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Special Characters - Check
    if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001120
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_ocredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Special Characters - Check
    the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Ensure authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters
        - Change the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Define a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Ensure the "ocredit" option from "pam_pwquality.so" is not present in {{ pam_file_path
      }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bocredit\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001120
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_ocredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Special Characters - Ensure
    PAM variable ocredit is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ocredit
    line: ocredit = {{ var_password_pam_ocredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001120
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_ocredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_ocredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_ocredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth" severity="medium">
                  <xccdf-1.2:title>Ensure PAM password complexity module is enabled in password-auth</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable PAM password complexity in password-auth file:
Edit the <html:code>password</html:code> section in
<html:code>/etc/pam.d/password-auth</html:code> to show
<html:code>password    requisite                                    pam_pwquality.so</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001010</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271614r1091554_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Enabling PAM password complexity permits to enforce strong passwords and consequently
makes the system less prone to dictionary attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwquality_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/pam.d/password-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/password-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if ! grep -qP "^\s*password\s+requisite\s+pam_pwquality.so\s*.*" "$PAM_FILE_PATH"; then
    # Line matching group + control + module was not found. Check group + module.
    if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwquality.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
        # The control is updated only if one single line matches.
        sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwquality.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
    else
        LAST_MATCH_LINE=$(grep -nP "^account.*required.*pam_permit\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
        if [ ! -z $LAST_MATCH_LINE ]; then
            sed -i --follow-symlinks $LAST_MATCH_LINE" a password     requisite    pam_pwquality.so" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwquality.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/password-auth was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwquality_password_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001010
  - accounts_password_pam_pwquality_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM password complexity module is enabled in password-auth - Check
    if /etc/pam.d/password-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001010
  - accounts_password_pam_pwquality_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM password complexity module is enabled in password-auth - Check
    the proper remediation for the system
  block:

  - name: Ensure PAM password complexity module is enabled in password-auth - Define
      the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Ensure PAM password complexity module is enabled in password-auth - Check
      if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
      authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM password complexity module is enabled in password-auth - Check
        integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM password complexity module is enabled in password-auth - Informative
        message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM password complexity module is enabled in password-auth - Get
        authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM password complexity module is enabled in password-auth - Define
        the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM password complexity module is enabled in password-auth - Define
        the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM password complexity module is enabled in password-auth - Get
        authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM password complexity module is enabled in password-auth - Check
        if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM password complexity module is enabled in password-auth - Create
        an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM password complexity module is enabled in password-auth - Create
        an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM password complexity module is enabled in password-auth - Restore
        the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM password complexity module is enabled in password-auth - Change
        the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM password complexity module is enabled in password-auth - Define
      a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: Ensure PAM password complexity module is enabled in password-auth - Check
      if expected PAM module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Ensure PAM password complexity module is enabled in password-auth - Include
      or update the PAM module line in {{ pam_file_path }}
    block:

    - name: Ensure PAM password complexity module is enabled in password-auth - Check
        if required PAM module line is present in {{ pam_file_path }} with different
        control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        the correct control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        the required PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^account.*required.*pam_permit\.so
        line: password    {{ pam_module_control }}    pam_pwquality.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
      authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_accounts_password_pam_pwquality_password_auth_add is defined and result_pam_accounts_password_pam_pwquality_password_auth_add.changed)
       or (result_pam_accounts_password_pam_pwquality_password_auth_edit is defined and result_pam_accounts_password_pam_pwquality_password_auth_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001010
  - accounts_password_pam_pwquality_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_pwquality_password_auth:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_pwquality_password_auth_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth" severity="medium">
                  <xccdf-1.2:title>Ensure PAM password complexity module is enabled in system-auth</xccdf-1.2:title>
                  <xccdf-1.2:description>To enable PAM password complexity in system-auth file:
Edit the <html:code>password</html:code> section in
<html:code>/etc/pam.d/system-auth</html:code> to show
<html:code>password    requisite                                    pam_pwquality.so</html:code>.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001000</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271611r1091545_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Enabling PAM password complexity permits to enforce strong passwords and consequently
makes the system less prone to dictionary attacks.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_pwquality_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if ! grep -qP "^\s*password\s+requisite\s+pam_pwquality.so\s*.*" "$PAM_FILE_PATH"; then
    # Line matching group + control + module was not found. Check group + module.
    if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwquality.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
        # The control is updated only if one single line matches.
        sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwquality.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
    else
        LAST_MATCH_LINE=$(grep -nP "^account.*required.*pam_permit\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
        if [ ! -z $LAST_MATCH_LINE ]; then
            sed -i --follow-symlinks $LAST_MATCH_LINE" a password     requisite    pam_pwquality.so" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwquality.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_pwquality_system_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001000
  - accounts_password_pam_pwquality_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM password complexity module is enabled in system-auth - Check if
    /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001000
  - accounts_password_pam_pwquality_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM password complexity module is enabled in system-auth - Check the
    proper remediation for the system
  block:

  - name: Ensure PAM password complexity module is enabled in system-auth - Define
      the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM password complexity module is enabled in system-auth - Check
      if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
      authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM password complexity module is enabled in system-auth - Check
        integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM password complexity module is enabled in system-auth - Informative
        message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM password complexity module is enabled in system-auth - Get
        authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM password complexity module is enabled in system-auth - Define
        the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM password complexity module is enabled in system-auth - Define
        the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM password complexity module is enabled in system-auth - Get
        authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM password complexity module is enabled in system-auth - Check
        if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM password complexity module is enabled in system-auth - Create
        an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM password complexity module is enabled in system-auth - Create
        an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM password complexity module is enabled in system-auth - Restore
        the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM password complexity module is enabled in system-auth - Change
        the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM password complexity module is enabled in system-auth - Define
      a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: Ensure PAM password complexity module is enabled in system-auth - Check
      if expected PAM module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Ensure PAM password complexity module is enabled in system-auth - Include
      or update the PAM module line in {{ pam_file_path }}
    block:

    - name: Ensure PAM password complexity module is enabled in system-auth - Check
        if required PAM module line is present in {{ pam_file_path }} with different
        control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        the correct control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        the required PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^account.*required.*pam_permit\.so
        line: password    {{ pam_module_control }}    pam_pwquality.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
      authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_accounts_password_pam_pwquality_system_auth_add is defined and result_pam_accounts_password_pam_pwquality_system_auth_add.changed)
       or (result_pam_accounts_password_pam_pwquality_system_auth_edit is defined and result_pam_accounts_password_pam_pwquality_system_auth_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001000
  - accounts_password_pam_pwquality_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_pwquality_system_auth:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_pwquality_system_auth_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</xccdf-1.2:title>
                  <xccdf-1.2:description>To configure the number of retry prompts that are permitted per-session:

Edit the <html:code>/etc/security/pwquality.conf</html:code> to include

<html:code>retry=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
          </html:code>, or a lower value if site
policy is more restrictive. The DoD requirement is a maximum of 3 prompts
per session.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001001</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271612r1091548_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks. Note that this
is different from account lockout, which is provided by the pam_faillock module.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_retry"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_retry='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^retry")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_retry"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^retry\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^retry\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi
	
		if [ -e "/etc/pam.d/password-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/password-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bretry\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bretry\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/password-auth was not found" &gt;&amp;2
fi
	
		if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bretry\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bretry\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_retry" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-001001
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_retry # promote to variable
  set_fact:
    var_password_pam_retry: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable retry is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^\s*retry
    line: retry = {{ var_password_pam_retry }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-001001
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Check if /etc/pam.d/password-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-001001
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure authselect custom profile is used if authselect
      is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Informative message based on the authselect integrity
        check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Define the new authselect custom profile as a local
        fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Get authselect current features to also enable them
        in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Check if any custom profile with the same name was
        already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Create an authselect custom profile based on the current
        profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Create an authselect custom profile based on sssd
        profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Change the PAM file to be edited according to the
        custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define a fact for control already filtered in case filters
      are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the "retry" option from "pam_pwquality.so" is
      not present in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bretry\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-001001
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Check if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-001001
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure authselect custom profile is used if authselect
      is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Informative message based on the authselect integrity
        check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Define the new authselect custom profile as a local
        fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Get authselect current features to also enable them
        in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Check if any custom profile with the same name was
        already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Create an authselect custom profile based on the current
        profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Create an authselect custom profile based on sssd
        profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Change the PAM file to be edited according to the
        custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define a fact for control already filtered in case filters
      are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the "retry" option from "pam_pwquality.so" is
      not present in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bretry\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.5.3
  - DISA-STIG-OL09-00-001001
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_retry:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_retry"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_retry:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" severity="medium">
                  <xccdf-1.2:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</xccdf-1.2:title>
                  <xccdf-1.2:description>The pam_pwquality module's <html:code>ucredit=</html:code> parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each uppercase character. Modify the <html:code>ucredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of an uppercase character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001005</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271613r1091551_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br/>
          <html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_pam"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_ucredit" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_ucredit='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>'





if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s.*\bpam_pwquality.so\s.*\bucredit\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*pam_pwquality.so.*)\bucredit\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi




# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ucredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ucredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ucredit\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^ucredit\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_ucredit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001005
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - accounts_password_pam_ucredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_ucredit # promote to variable
  set_fact:
    var_password_pam_ucredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters -
    Check if /etc/pam.d/system-auth file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001005
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - accounts_password_pam_ucredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters -
    Check the proper remediation for the system
  block:

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Define the PAM file to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Ensure authselect custom profile is used if authselect is present
    block:

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Define the current authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Define the new authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Get authselect current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Check if any custom profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Create an authselect custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Create an authselect custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Ensure the authselect custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Restore the authselect features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
        - Change the PAM file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Define a fact for control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: ''

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Ensure the "ucredit" option from "pam_pwquality.so" is not present in {{ pam_file_path
      }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (.*password.*pam_pwquality.so.*)\bucredit\b=?[0-9a-zA-Z]*(.*)
      replace: \1\2
    register: result_pam_option_removal

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_option_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001005
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - accounts_password_pam_ucredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters -
    Ensure PAM variable ucredit is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ucredit
    line: ucredit = {{ var_password_pam_ucredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001005
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - accounts_password_pam_ucredit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_ucredit:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm">
              <xccdf-1.2:title>Set Password Hashing Algorithm</xccdf-1.2:title>
              <xccdf-1.2:description>The system's default algorithm for storing password hashes in
<html:code>/etc/shadow</html:code> is SHA-512. This can be configured in several
locations.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" type="number">
                <xccdf-1.2:title>Minimum number of password hashing rounds configured through /etc/login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>Minimum number of password hashing rounds configured through /etc/login.defs</xccdf-1.2:description>
                <xccdf-1.2:value>5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="5000">5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="100000">100000</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" severity="medium">
                <xccdf-1.2:title>Set Password Hashing Algorithm in /etc/libuser.conf</xccdf-1.2:title>
                <xccdf-1.2:description>In <html:code>/etc/libuser.conf</html:code>, add or correct the following line in its <html:code>[defaults]</html:code>
section to ensure the system will use the <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
algorithm for password hashing:
<html:pre>crypt_style = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271622r1091578_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br/>
         <html:br/>
This setting ensures user and group account administration utilities are configured to store
only encrypted representations of passwords. Additionally, the <html:code>crypt_style</html:code>
configuration option in <html:code>/etc/libuser.conf</html:code> ensures the use of a strong hashing
algorithm that makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_libuser"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_libuserconf"># Remediation is applicable only in certain platforms
if rpm --quiet -q libuser; then

var_password_hashing_algorithm_pam='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>'

LIBUSER_CONF="/etc/libuser.conf"
CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*'

# Try find crypt_style in [defaults] section. If it is here, then change algorithm to sha512.
# If it isn't here, then add it to [defaults] section.
if grep -qzosP $CRYPT_STYLE_REGEX $LIBUSER_CONF ; then
        sed -i "s/\(crypt_style[[:space:]]*=[[:space:]]*\).*/\1$var_password_hashing_algorithm_pam/g" $LIBUSER_CONF
elif grep -qs "\[defaults]" $LIBUSER_CONF ; then
        sed -i "/[[:space:]]*\[defaults]/a crypt_style = $var_password_hashing_algorithm_pam" $LIBUSER_CONF
else
        echo -e "[defaults]\ncrypt_style = $var_password_hashing_algorithm_pam" &gt;&gt; $LIBUSER_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_algorithm_libuserconf" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001050
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_algorithm_libuserconf
- name: XCCDF Value var_password_hashing_algorithm_pam # promote to variable
  set_fact:
    var_password_hashing_algorithm_pam: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Algorithm in /etc/libuser.conf - Set Password Hashing
    Algorithm in /etc/libuser.conf
  ansible.builtin.lineinfile:
    dest: /etc/libuser.conf
    insertafter: ^\s*\[defaults]
    regexp: ^#?crypt_style
    line: crypt_style = {{ var_password_hashing_algorithm_pam }}
    state: present
    create: true
  when: '"libuser" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001050
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_algorithm_libuserconf
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_algorithm_pam:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" severity="medium">
                <xccdf-1.2:title>Set Password Hashing Algorithm in /etc/login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>In <html:code>/etc/login.defs</html:code>, add or update the following line to ensure the system will use
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/> as the hashing algorithm:
<html:pre>ENCRYPT_METHOD <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.19.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271623r1091581_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br/>
         <html:br/>
Using a stronger hashing algorithm makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_logindefs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_password_hashing_algorithm='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>'


# Allow multiple algorithms, but choose the first one for remediation
#
var_password_hashing_algorithm="$(echo $var_password_hashing_algorithm | cut -d \| -f 1)"

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ENCRYPT_METHOD")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_password_hashing_algorithm"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ENCRYPT_METHOD\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^ENCRYPT_METHOD\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_algorithm_logindefs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001055
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_algorithm_logindefs
- name: XCCDF Value var_password_hashing_algorithm # promote to variable
  set_fact:
    var_password_hashing_algorithm: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Algorithm in /etc/login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^#?ENCRYPT_METHOD
    line: ENCRYPT_METHOD {{ var_password_hashing_algorithm.split('|')[0] }}
    state: present
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001055
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_algorithm_logindefs
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" severity="medium">
                <xccdf-1.2:title>Set PAM''s Password Hashing Algorithm - password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>The PAM system service can be configured to only store encrypted representations of passwords.
In <html:code>/etc/pam.d/password-auth</html:code>, the <html:code>password</html:code> section of the file controls which
PAM modules to execute during a password change.

Set the <html:code>pam_unix.so</html:code> module in the <html:code>password</html:code> section to include the option
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/></html:code> and no other hashing
algorithms as shown below:
<html:br/>
         <html:pre>password    sufficient    pam_unix.so <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
          <html:i>other arguments...</html:i>
         </html:pre>
         <html:br/>
This will help ensure that new passwords for local users will be stored using the
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/> algorithm.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The hashing algorithms to be used with pam_unix.so are defined with independent module
options. There are at least 7 possible algorithms and likely more algorithms will be
introduced along the time. Due the the number of options and its possible combinations,
the use of multiple hashing algorithm options may bring unexpected behaviors to the
system. For this reason the check will pass only when one hashing algorithm option is
defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The
remediation will ensure the correct option and remove any other extra hashing algorithm
option.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.19.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271624r1091584_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br/>
         <html:br/>
This setting ensures user and group account administration utilities are configured to store
only encrypted representations of passwords. Additionally, the <html:code>crypt_style</html:code>
configuration option in <html:code>/etc/libuser.conf</html:code> ensures the use of a strong hashing
algorithm that makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_passwordauth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_hashing_algorithm_pam='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>'

PAM_FILE_PATH="/etc/pam.d/password-auth"

if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
            else
                echo "password    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\s$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ $var_password_hashing_algorithm_pam/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi

# Ensure only the correct hashing algorithm option is used.
declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blowfish" "sha256" "md5" "bigcrypt")

for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do
  if [ "$hash_option" != "$var_password_hashing_algorithm_pam" ]; then
    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then
      if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s+.*\s+pam_unix.so\s.*\b$hash_option\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*.*.*pam_unix.so.*)\s$hash_option=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi
    fi
  fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_algorithm_passwordauth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001060
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth
- name: XCCDF Value var_password_hashing_algorithm_pam # promote to variable
  set_fact:
    var_password_hashing_algorithm_pam: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
  tags:
    - always

- name: Set PAM's Password Hashing Algorithm - password-auth - Check if /etc/pam.d/password-auth
    file is present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001060
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth

- name: Set PAM's Password Hashing Algorithm - password-auth - Check the proper remediation
    for the system
  block:

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - password-auth - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the new
        authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Change the PAM
        file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if expected
      PAM module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Include or update
      the PAM module line in {{ pam_file_path }}
    block:

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check if required
        PAM module line is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_unix.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the correct
        control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the required
        PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_unix.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if the required
      PAM module option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\s{{
        var_password_hashing_algorithm_pam }}\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_set_password_hashing_algorithm_passwordauth_option_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the "{{ var_password_hashing_algorithm_pam
      }}" PAM option for "pam_unix.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
      line: \1 {{ var_password_hashing_algorithm_pam }}
      state: present
    register: result_pam_set_password_hashing_algorithm_passwordauth_add
    when:
    - result_pam_module_set_password_hashing_algorithm_passwordauth_option_present.found
      == 0

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_set_password_hashing_algorithm_passwordauth_add is defined and result_pam_set_password_hashing_algorithm_passwordauth_add.changed)
       or (result_pam_set_password_hashing_algorithm_passwordauth_edit is defined and result_pam_set_password_hashing_algorithm_passwordauth_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001060
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth

- name: Set PAM's Password Hashing Algorithm - password-auth - Check if /etc/pam.d/password-auth
    File is Present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001060
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth

- name: Set PAM's Password Hashing Algorithm - password-auth - Check The Proper Remediation
    For The System
  block:

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - password-auth - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the new
        authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Change the PAM
        file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure That Only
      the Correct Hashing Algorithm Option For pam_unix.so Is Used in /etc/pam.d/password-auth
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
      replace: \1\2
    when: item != var_password_hashing_algorithm_pam
    loop:
    - sha512
    - yescrypt
    - gost_yescrypt
    - blowfish
    - sha256
    - md5
    - bigcrypt
    register: result_pam_hashing_options_removal

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_hashing_options_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - DISA-STIG-OL09-00-001060
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_algorithm_pam:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_passwordauth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" severity="medium">
                <xccdf-1.2:title>Set PAM''s Password Hashing Algorithm</xccdf-1.2:title>
                <xccdf-1.2:description>The PAM system service can be configured to only store encrypted representations of passwords.
In "/etc/pam.d/system-auth", the <html:code>password</html:code> section of the file controls which
PAM modules to execute during a password change.

Set the <html:code>pam_unix.so</html:code> module in the <html:code>password</html:code> section to include the option
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/></html:code> and no other hashing
algorithms as shown below:
<html:br/>
         <html:pre>password    sufficient    pam_unix.so <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
          <html:i>other arguments...</html:i>
         </html:pre>
         <html:br/>
This will help ensure that new passwords for local users will be stored using the
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/> algorithm.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">The hashing algorithms to be used with pam_unix.so are defined with independent module
options. There are at least 7 possible algorithms and likely more algorithms will be
introduced along the time. Due the the number of options and its possible combinations,
the use of multiple hashing algorithm options may bring unexpected behaviors to the
system. For this reason the check will pass only when one hashing algorithm option is
defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The
remediation will ensure the correct option and remove any other extra hashing algorithm
option.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.19.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br/>
         <html:br/>
This setting ensures user and group account administration utilities are configured to store
only encrypted representations of passwords. Additionally, the <html:code>crypt_style</html:code>
configuration option in <html:code>/etc/libuser.conf</html:code> ensures the use of a strong hashing
algorithm that makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_algorithm_systemauth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_hashing_algorithm_pam='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>'


PAM_FILE_PATH="/etc/pam.d/system-auth"


if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
            else
                echo "password    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\s$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ $var_password_hashing_algorithm_pam/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi

# Ensure only the correct hashing algorithm option is used.
declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blowfish" "sha256" "md5" "bigcrypt")

for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do
  if [ "$hash_option" != "$var_password_hashing_algorithm_pam" ]; then
    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then
      if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s+.*\s+pam_unix.so\s.*\b$hash_option\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*.*.*pam_unix.so.*)\s$hash_option=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi
    fi
  fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_algorithm_systemauth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth
- name: XCCDF Value var_password_hashing_algorithm_pam # promote to variable
  set_fact:
    var_password_hashing_algorithm_pam: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
  tags:
    - always

- name: Set PAM's Password Hashing Algorithm - Check if /etc/pam.d/system-auth file
    is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth

- name: Set PAM's Password Hashing Algorithm - Check the proper remediation for the
    system
  block:

  - name: Set PAM's Password Hashing Algorithm - Define the PAM file to be edited
      as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Set PAM's Password Hashing Algorithm - Check if system relies on authselect
      tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect custom profile
      is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - Check integrity of authselect current
        profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - Informative message based on the
        authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - Define the current authselect profile
        as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Define the new authselect custom
        profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Get authselect current features
        to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Check if any custom profile with
        the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Ensure the authselect custom profile
        is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Restore the authselect features
        in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - Change the PAM file to be edited
        according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - Define a fact for control already
      filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - Check if expected PAM module line
      is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Set PAM's Password Hashing Algorithm - Include or update the PAM module
      line in {{ pam_file_path }}
    block:

    - name: Set PAM's Password Hashing Algorithm - Check if required PAM module line
        is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_unix.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Set PAM's Password Hashing Algorithm - Ensure the correct control for
        the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Set PAM's Password Hashing Algorithm - Ensure the required PAM module
        line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_unix.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Set PAM's Password Hashing Algorithm - Define a fact for control already
      filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - Check if the required PAM module
      option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\s{{
        var_password_hashing_algorithm_pam }}\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_set_password_hashing_algorithm_systemauth_option_present

  - name: Set PAM's Password Hashing Algorithm - Ensure the "{{ var_password_hashing_algorithm_pam
      }}" PAM option for "pam_unix.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
      line: \1 {{ var_password_hashing_algorithm_pam }}
      state: present
    register: result_pam_set_password_hashing_algorithm_systemauth_add
    when:
    - result_pam_module_set_password_hashing_algorithm_systemauth_option_present.found
      == 0

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_set_password_hashing_algorithm_systemauth_add is defined and result_pam_set_password_hashing_algorithm_systemauth_add.changed)
       or (result_pam_set_password_hashing_algorithm_systemauth_edit is defined and result_pam_set_password_hashing_algorithm_systemauth_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth

- name: Set PAM's Password Hashing Algorithm - Check if /etc/pam.d/system-auth File
    is Present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth

- name: Set PAM's Password Hashing Algorithm - Check The Proper Remediation For The
    System
  block:

  - name: Set PAM's Password Hashing Algorithm - Define the PAM file to be edited
      as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Set PAM's Password Hashing Algorithm - Check if system relies on authselect
      tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect custom profile
      is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - Check integrity of authselect current
        profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - Informative message based on the
        authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - Define the current authselect profile
        as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Define the new authselect custom
        profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Get authselect current features
        to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Check if any custom profile with
        the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Ensure the authselect custom profile
        is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Restore the authselect features
        in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - Change the PAM file to be edited
        according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - Ensure That Only the Correct Hashing
      Algorithm Option For pam_unix.so Is Used in /etc/pam.d/system-auth
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
      replace: \1\2
    when: item != var_password_hashing_algorithm_pam
    loop:
    - sha512
    - yescrypt
    - gost_yescrypt
    - blowfish
    - sha256
    - md5
    - bigcrypt
    register: result_pam_hashing_options_removal

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_hashing_options_removal is changed
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_algorithm_pam:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs" severity="medium">
                <xccdf-1.2:title>Set Password Hashing Rounds in /etc/login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>In <html:code>/etc/login.defs</html:code>, ensure <html:code>SHA_CRYPT_MIN_ROUNDS</html:code> and
<html:code>SHA_CRYPT_MAX_ROUNDS</html:code> has the minimum value of <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" use="legacy"/></html:code>.
For example:
<html:pre>SHA_CRYPT_MIN_ROUNDS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" use="legacy"/>
SHA_CRYPT_MAX_ROUNDS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" use="legacy"/>
         </html:pre>
Notice that if neither are set, they already have the default value of 5000.
If either is set, they must have the minimum value of <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" use="legacy"/>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001075</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271627r1091593_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords
that are encrypted with a weak algorithm are no more protected than if
they are kept in plain text.
<html:br/>
         <html:br/>
Using more hashing rounds makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_password_hashing_min_rounds_logindefs">
var_password_hashing_min_rounds_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" use="legacy"/>'


config_file="/etc/login.defs"
current_min_rounds=$(grep -Po '^\s*SHA_CRYPT_MIN_ROUNDS\s+\K\d+' "$config_file")
current_max_rounds=$(grep -Po '^\s*SHA_CRYPT_MAX_ROUNDS\s+\K\d+' "$config_file")

if [[ -z "$current_min_rounds" || "$current_min_rounds" -le "$var_password_hashing_min_rounds_login_defs" ]]; then
    if [ -e "/etc/login.defs" ] ; then
        
        LC_ALL=C sed -i "/^\s*SHA_CRYPT_MIN_ROUNDS\s*/Id" "/etc/login.defs"
    else
        printf '%s\n' "Path '/etc/login.defs' wasn't found on this system. Refusing to continue." &gt;&amp;2
        return 1
    fi
    # make sure file has newline at the end
    sed -i -e '$a\' "/etc/login.defs"

    cp "/etc/login.defs" "/etc/login.defs.bak"
    # Insert at the end of the file
    printf '%s\n' "SHA_CRYPT_MIN_ROUNDS $var_password_hashing_min_rounds_login_defs" &gt;&gt; "/etc/login.defs"
    # Clean up after ourselves.
    rm "/etc/login.defs.bak"
fi

if [[ -n "$current_max_rounds" &amp;&amp; "$current_max_rounds" -le "$var_password_hashing_min_rounds_login_defs" ]]; then
    if [ -e "/etc/login.defs" ] ; then
        
        LC_ALL=C sed -i "/^\s*SHA_CRYPT_MAX_ROUNDS\s*/Id" "/etc/login.defs"
    else
        printf '%s\n' "Path '/etc/login.defs' wasn't found on this system. Refusing to continue." &gt;&amp;2
        return 1
    fi
    # make sure file has newline at the end
    sed -i -e '$a\' "/etc/login.defs"

    cp "/etc/login.defs" "/etc/login.defs.bak"
    # Insert at the end of the file
    printf '%s\n' "SHA_CRYPT_MAX_ROUNDS $var_password_hashing_min_rounds_login_defs" &gt;&gt; "/etc/login.defs"
    # Clean up after ourselves.
    rm "/etc/login.defs.bak"
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="set_password_hashing_min_rounds_logindefs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_password_hashing_min_rounds_login_defs # promote to variable
  set_fact:
    var_password_hashing_min_rounds_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Rounds in /etc/login.defs - extract contents of the file
    /etc/login.defs
  ansible.builtin.slurp:
    src: /etc/login.defs
  register: etc_login_defs
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - extract the value of SHA_CRYPT_MIN_ROUNDS
    if present
  ansible.builtin.set_fact:
    etc_login_defs_sha_crypt_min_rounds: '{{ etc_login_defs[''content''] | b64decode
      | regex_search(''^\s*SHA_CRYPT_MIN_ROUNDS\s+(\d+)'', ''\1'', multiline=True)
      | default([], true) }}'
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - extract the value of SHA_CRYPT_MAX_ROUNDS
    if present
  ansible.builtin.set_fact:
    etc_login_defs_sha_crypt_max_rounds: '{{ etc_login_defs[''content''] | b64decode
      | regex_search(''^\s*SHA_CRYPT_MAX_ROUNDS\s+(\d+)'', ''\1'', multiline=True)
      | default([], true) }}'
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Ensure SHA_CRYPT_MIN_ROUNDS
    has Minimum Value of 5000
  ansible.builtin.replace:
    path: /etc/login.defs
    regexp: (^\s*SHA_CRYPT_MIN_ROUNDS\s+)(?:\d+)(.*$)
    replace: \g&lt;1&gt;{{ var_password_hashing_min_rounds_login_defs }}\g&lt;2&gt;
    backup: false
  when: etc_login_defs_sha_crypt_min_rounds is defined and etc_login_defs_sha_crypt_min_rounds
    | length &gt; 0 and etc_login_defs_sha_crypt_min_rounds | first | int &lt; var_password_hashing_min_rounds_login_defs
    | int
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - Ensure SHA_CRYPT_MAX_ROUNDS
    has Minimum Value of 5000
  ansible.builtin.replace:
    path: /etc/login.defs
    regexp: (^\s*SHA_CRYPT_MAX_ROUNDS\s+)(?:\d+)(.*$)
    replace: \g&lt;1&gt;{{ var_password_hashing_min_rounds_login_defs }}\g&lt;2&gt;
    backup: false
  when: etc_login_defs_sha_crypt_max_rounds is defined and etc_login_defs_sha_crypt_max_rounds
    | length &gt; 0 and etc_login_defs_sha_crypt_max_rounds | first | int &lt; var_password_hashing_min_rounds_login_defs
    | int
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - SHA_CRYPT_MIN_ROUNDS add
    configuration if not found
  ansible.builtin.lineinfile:
    line: SHA_CRYPT_MIN_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
    path: /etc/login.defs
    state: present
  when: etc_login_defs_sha_crypt_min_rounds | length == 0
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs

- name: Set Password Hashing Rounds in /etc/login.defs - SHA_CRYPT_MAX_ROUNDS add
    configuration if not found
  ansible.builtin.lineinfile:
    line: SHA_CRYPT_MAX_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
    path: /etc/login.defs
    state: present
  when: etc_login_defs_sha_crypt_max_rounds | length == 0
  tags:
  - DISA-STIG-OL09-00-001075
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_min_rounds_logindefs
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_min_rounds_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_min_rounds_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-set_password_hashing_min_rounds_logindefs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_password_hashing_min_rounds_logindefs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-physical">
            <xccdf-1.2:title>Protect Physical Console Access</xccdf-1.2:title>
            <xccdf-1.2:description>It is impossible to fully protect a system from an
attacker with physical access, so securing the space in which the
system is located should be considered a necessary step. However,
there are some steps which, if taken, make it more difficult for an
attacker to quickly or undetectably modify a system from its
console.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logind_session_timeout" type="number">
              <xccdf-1.2:title>Login timeout for idle sessions</xccdf-1.2:title>
              <xccdf-1.2:description>Specify duration of allowed idle time.</xccdf-1.2:description>
              <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
              <xccdf-1.2:value selector="120_minutes">7200</xccdf-1.2:value>
              <xccdf-1.2:value selector="14_minutes">840</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
              <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
              <xccdf-1.2:value selector="60_minutes">3600</xccdf-1.2:value>
              <xccdf-1.2:value>300</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" severity="medium">
              <xccdf-1.2:title>Disable debug-shell SystemD Service</xccdf-1.2:title>
              <xccdf-1.2:description>SystemD's <html:code>debug-shell</html:code> service is intended to
diagnose SystemD related boot issues with various <html:code>systemctl</html:code>
commands. Once enabled and following a system reboot, the root shell
will be available on <html:code>tty9</html:code> which is access by pressing
<html:code>CTRL-ALT-F9</html:code>. The <html:code>debug-shell</html:code> service should only be used
for SystemD related issues and should otherwise be disabled.
<html:br/>
        <html:br/>
By default, the <html:code>debug-shell</html:code> SystemD service is already disabled.

The <html:code>debug-shell</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now debug-shell.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271742r1091938_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine through valid troubleshooting configurations and gaining root
access when the system is rebooted.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_debug-shell_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'debug-shell.service'
fi
"$SYSTEMCTL_EXEC" disable 'debug-shell.service'
"$SYSTEMCTL_EXEC" mask 'debug-shell.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files debug-shell.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'debug-shell.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'debug-shell.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'debug-shell.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_debug-shell_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002403
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_debug-shell_disabled

- name: Disable debug-shell SystemD Service - Collect systemd Services Present in
    the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002403
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_debug-shell_disabled

- name: Disable debug-shell SystemD Service - Ensure debug-shell.service is Masked
  ansible.builtin.systemd:
    name: debug-shell.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("debug-shell.service", multiline=True)
  tags:
  - DISA-STIG-OL09-00-002403
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_debug-shell_disabled

- name: Unit Socket Exists - debug-shell.socket
  ansible.builtin.command: systemctl -q list-unit-files debug-shell.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002403
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_debug-shell_disabled

- name: Disable debug-shell SystemD Service - Disable Socket debug-shell
  ansible.builtin.systemd:
    name: debug-shell.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("debug-shell.socket", multiline=True)
  tags:
  - DISA-STIG-OL09-00-002403
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_debug-shell_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_debug-shell_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_debug-shell

class disable_debug-shell {
  service {'debug-shell':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_debug-shell_disabled">
[customizations.services]
masked = ["debug-shell"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_debug-shell_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" severity="high">
              <xccdf-1.2:title>Disable Ctrl-Alt-Del Burst Action</xccdf-1.2:title>
              <xccdf-1.2:description>By default, <html:code>SystemD</html:code> will reboot the system if the <html:code>Ctrl-Alt-Del</html:code>
key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds.
<html:br/>
        <html:br/>
To configure the system to ignore the <html:code>CtrlAltDelBurstAction</html:code>

setting, add or modify the following to <html:code>/etc/systemd/system.conf</html:code>:
<html:pre>CtrlAltDelBurstAction=none</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">Disabling the <html:code>Ctrl-Alt-Del</html:code> key sequence
in <html:code>/etc/init/control-alt-delete.conf</html:code> DOES NOT disable the <html:code>Ctrl-Alt-Del</html:code>
key sequence if running in <html:code>runlevel 6</html:code> (e.g. in GNOME, KDE, etc.)! The
<html:code>Ctrl-Alt-Del</html:code> key sequence will only be disabled if running in
the non-graphical <html:code>runlevel 3</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002412</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271751r1091965_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_systemd"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disable_ctrlaltdel_burstaction"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q systemd; }; then

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^CtrlAltDelBurstAction=")

# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "none"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^CtrlAltDelBurstAction=\\&gt;" "/etc/systemd/system.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^CtrlAltDelBurstAction=\\&gt;.*/$escaped_formatted_output/gi" "/etc/systemd/system.conf"
else
    if [[ -s "/etc/systemd/system.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/systemd/system.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/system.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/systemd/system.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_ctrlaltdel_burstaction" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002412
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - disable_ctrlaltdel_burstaction
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed

- name: Disable Ctrl-Alt-Del Burst Action
  lineinfile:
    dest: /etc/systemd/system.conf
    state: present
    regexp: ^CtrlAltDelBurstAction
    line: CtrlAltDelBurstAction=none
    create: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"systemd" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002412
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - disable_ctrlaltdel_burstaction
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-disable_ctrlaltdel_burstaction:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-disable_ctrlaltdel_burstaction_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" severity="high">
              <xccdf-1.2:title>Disable Ctrl-Alt-Del Reboot Activation</xccdf-1.2:title>
              <xccdf-1.2:description>By default, <html:code>SystemD</html:code> will reboot the system if the <html:code>Ctrl-Alt-Del</html:code>
key sequence is pressed.
<html:br/>
        <html:br/>
To configure the system to ignore the <html:code>Ctrl-Alt-Del</html:code> key sequence from the

command line instead of rebooting the system, do either of the following:
<html:pre>ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target</html:pre>
or
<html:pre>systemctl mask ctrl-alt-del.target</html:pre>
        <html:br/>
        <html:br/>
Do not simply delete the <html:code>/usr/lib/systemd/system/ctrl-alt-del.service</html:code> file,
as this file may be restored during future system updates.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002413</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271752r1091968_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A locally logged-in user who presses Ctrl-Alt-Del, when at the console,
can reboot the system. If accidentally pressed, as could happen in
the case of mixed OS environment, this can create the risk of short-term
loss of availability of systems due to unintentional reboot.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disable_ctrlaltdel_reboot"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    systemctl disable ctrl-alt-del.target
    systemctl mask ctrl-alt-del.target
else
    systemctl disable --now ctrl-alt-del.target
    systemctl mask --now ctrl-alt-del.target
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_ctrlaltdel_reboot" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002413
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_ctrlaltdel_reboot
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed

- name: Disable Ctrl-Alt-Del Reboot Activation
  systemd:
    name: ctrl-alt-del.target
    force: true
    masked: true
    state: stopped
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002413
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_ctrlaltdel_reboot
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-disable_ctrlaltdel_reboot:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" severity="medium">
              <xccdf-1.2:title>Verify that Interactive Boot is Disabled</xccdf-1.2:title>
              <xccdf-1.2:description>Oracle Linux 9 systems support an "interactive boot" option that can
be used to prevent services from being started. On a Oracle Linux 9
system, interactive boot can be enabled by providing a <html:code>1</html:code>,
<html:code>yes</html:code>, <html:code>true</html:code>, or <html:code>on</html:code> value to the
<html:code>systemd.confirm_spawn</html:code> kernel argument in <html:code>/etc/default/grub</html:code>.
Remove any instance of <html:pre>systemd.confirm_spawn=(1|yes|true|on)</html:pre> from
the kernel arguments in that file to disable interactive boot.
Recovery booting must also be disabled. Confirm that
<html:code>GRUB_DISABLE_RECOVERY=true</html:code> is set in  <html:code>/etc/default/grub</html:code>.
It is also required to change the runtime configuration, run:

<html:pre>/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"</html:pre>
        <html:pre>grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-2(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002392</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271736r1091920_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Using interactive or recovery boot, the console user could disable auditing, firewalls,
or other services, weakening system security.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#grub2"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_disable_interactive_boot" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q grub2-common; }; then

# Verify that Interactive Boot is Disabled in /etc/default/grub
CONFIRM_SPAWN_YES="systemd.confirm_spawn\(=\(1\|yes\|true\|on\)\|\b\)"
CONFIRM_SPAWN_NO="systemd.confirm_spawn=no"

if grep -q "\(GRUB_CMDLINE_LINUX\|GRUB_CMDLINE_LINUX_DEFAULT\)" /etc/default/grub
then
	sed -i "s/${CONFIRM_SPAWN_YES}/${CONFIRM_SPAWN_NO}/" /etc/default/grub
fi

# make sure GRUB_DISABLE_RECOVERY=true
if grep -q '^GRUB_DISABLE_RECOVERY=.*'  '/etc/default/grub' ; then
       # modify the GRUB command-line if an GRUB_DISABLE_RECOVERY= arg already exists
       sed -i 's/GRUB_DISABLE_RECOVERY=.*/GRUB_DISABLE_RECOVERY=true/' /etc/default/grub
else
       # no GRUB_DISABLE_RECOVERY=arg is present, append it to file
       echo "GRUB_DISABLE_RECOVERY=true"  &gt;&gt; '/etc/default/grub'
fi



# Remove 'systemd.confirm_spawn' kernel argument also from runtime settings
/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"


#Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
grub2-mkconfig -o /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_disable_interactive_boot" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002392
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify GRUB_DISABLE_RECOVERY=true
  lineinfile:
    path: /etc/default/grub
    regexp: ^GRUB_DISABLE_RECOVERY=.*
    line: GRUB_DISABLE_RECOVERY=true
    state: present
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002392
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify that Interactive Boot is Disabled in /etc/default/grub
  replace:
    dest: /etc/default/grub
    regexp: systemd.confirm_spawn(=(1|yes|true|on)|\b)
    replace: systemd.confirm_spawn=no
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002392
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify that Interactive Boot is Disabled (runtime)
  command: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002392
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
  command: grub2-mkconfig -o  /boot/grub2/grub.cfg
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002392
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_disable_interactive_boot:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_disable_interactive_boot_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_logind_session_timeout" severity="medium">
              <xccdf-1.2:title>Configure Logind to terminate idle sessions after certain time of inactivity</xccdf-1.2:title>
              <xccdf-1.2:description>To configure <html:code>logind</html:code> service to terminate inactive user sessions
after <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_logind_session_timeout" use="legacy"/> seconds, edit the file
<html:code>/etc/systemd/logind.conf</html:code>. Ensure that there is a section
<html:pre>[Login]</html:pre> which contains the configuration
<html:pre>StopIdleSessionSec=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_logind_session_timeout" use="legacy"/>
        </html:pre>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R32</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Terminating an idle session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management
session enabled on the console or console port that has been let unattended.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#os_linux_ol_gt_or_eq_8_7"/>
              <xccdf-1.2:platform idref="#os_linux_rhel_gt_or_eq_8_7_and_os_linux_rhel_ne_9_0"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="logind_session_timeout"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ( grep -qP "^ID=[\"']?rhel[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="8.7"; printf "%s\n%s" "$expected" "$real" | sort -VC; } &amp;&amp; grep -qP "^ID=[\"']?rhel[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="9.0"; [[ "$real" != "$expected" ]]; } ) || grep -qP "^ID=[\"']?ol[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="8.7"; printf "%s\n%s" "$expected" "$real" | sort -VC; }; }; then

var_logind_session_timeout='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_logind_session_timeout" use="legacy"/>'



# Try find '[Login]' and 'StopIdleSessionSec' in '/etc/systemd/logind.conf', if it exists, set
# to '$var_logind_session_timeout', if it isn't here, add it, if '[Login]' doesn't exist, add it there
if grep -qzosP '[[:space:]]*\[Login]([^\n\[]*\n+)+?[[:space:]]*StopIdleSessionSec' '/etc/systemd/logind.conf'; then
    
    sed -i "s/StopIdleSessionSec[^(\n)]*/StopIdleSessionSec=$var_logind_session_timeout/" '/etc/systemd/logind.conf'
elif grep -qs '[[:space:]]*\[Login]' '/etc/systemd/logind.conf'; then
    sed -i "/[[:space:]]*\[Login]/a StopIdleSessionSec=$var_logind_session_timeout" '/etc/systemd/logind.conf'
else
    if test -d "/etc/systemd"; then
        printf '%s\n' '[Login]' "StopIdleSessionSec=$var_logind_session_timeout" &gt;&gt; '/etc/systemd/logind.conf'
    else
        echo "Config file directory '/etc/systemd' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="logind_session_timeout" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - logind_session_timeout
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_logind_session_timeout # promote to variable
  set_fact:
    var_logind_session_timeout: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_logind_session_timeout" use="legacy"/>
  tags:
    - always

- name: Set 'StopIdleSessionSec' to '{{ var_logind_session_timeout }}' in the [Login]
    section of '/etc/systemd/logind.conf'
  ini_file:
    path: /etc/systemd/logind.conf
    section: Login
    option: StopIdleSessionSec
    value: '{{ var_logind_session_timeout }}'
    create: true
    mode: 420
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.7',
    '&gt;=') and ansible_distribution == 'RedHat' and ansible_distribution_version is
    version('9.0', '!=') ) or ansible_distribution == 'OracleLinux' and ansible_distribution_version
    is version('8.7', '&gt;=')
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - logind_session_timeout
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_logind_session_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_logind_session_timeout"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-logind_session_timeout:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-logind_session_timeout_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_require_emergency_target_auth" severity="medium">
              <xccdf-1.2:title>Require Authentication for Emergency Systemd Target</xccdf-1.2:title>
              <xccdf-1.2:description>Emergency mode is intended as a system recovery
method, providing a single user root access to the system
during a failed boot sequence.
<html:br/>
        <html:br/>
By default, Emergency mode is protected by requiring a password and is set
in <html:code>/usr/lib/systemd/system/emergency.service</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000025</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271441r1091035_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="require_emergency_target_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

service_file="/usr/lib/systemd/system/emergency.service"


sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency"


if grep "^ExecStart=.*" "$service_file" ; then
    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
else
    echo "ExecStart=-$sulogin" &gt;&gt; "$service_file"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="require_emergency_target_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000025
  - NIST-800-171-3.1.1
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - require_emergency_target_auth
  - restrict_strategy

- name: Require emergency mode password
  lineinfile:
    create: true
    dest: /usr/lib/systemd/system/emergency.service
    regexp: ^#?ExecStart=
    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000025
  - NIST-800-171-3.1.1
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - require_emergency_target_auth
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-require_emergency_target_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-require_emergency_target_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_require_singleuser_auth" severity="medium">
              <xccdf-1.2:title>Require Authentication for Single User Mode</xccdf-1.2:title>
              <xccdf-1.2:description>Single-user mode is intended as a system recovery
method, providing a single user root access to the system by
providing a boot option at startup.
<html:br/>
        <html:br/>
By default, single-user mode is protected by requiring a password and is set
in <html:code>/usr/lib/systemd/system/rescue.service</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000030</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271442r1091038_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine and gaining root access. Such accesses are further prevented
by configuring the bootloader password.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="require_singleuser_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/systemd/system/rescue.service.d/10-oscap.conf /etc/systemd/system/rescue.service.d/*.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[Service\]([^\n\[]*\n+)+?[[:space:]]*ExecStart" "$f"; then

            sed -i "s/ExecStart[^(\n)]*/ExecStart=\nExecStart=-\/usr\/lib\/systemd\/systemd-sulogin-shell rescue/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[Service\]" "$f"; then

            sed -i "/[[:space:]]*\[Service\]/a ExecStart=\nExecStart=-\/usr\/lib\/systemd\/systemd-sulogin-shell rescue" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/systemd/system/rescue.service.d/10-oscap.conf /etc/systemd/system/rescue.service.d/*.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[Service]\nExecStart=\nExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="require_singleuser_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000030
  - NIST-800-171-3.1.1
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - require_singleuser_auth
  - restrict_strategy

- name: Require Authentication for Single User Mode - Require single user mode password
  lineinfile:
    create: true
    dest: /usr/lib/systemd/system/rescue.service
    regexp: ^#?ExecStart=
    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000030
  - NIST-800-171-3.1.1
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - require_singleuser_auth
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-require_singleuser_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_screen_locking">
              <xccdf-1.2:title>Configure Screen Locking</xccdf-1.2:title>
              <xccdf-1.2:description>When a user must temporarily leave an account
logged-in, screen locking should be employed to prevent passersby
from abusing the account. User education and training is
particularly important for screen locking to be effective, and policies
can be implemented to reinforce this.
<html:br/>
        <html:br/>
Automatic screen locking is only meant as a safeguard for
those cases where a user forgot to lock the screen.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smart_card_login">
                <xccdf-1.2:title>Hardware Tokens for Authentication</xccdf-1.2:title>
                <xccdf-1.2:description>The use of hardware tokens such as smart cards for system login
provides stronger, two-factor authentication than using a username and password.

In Oracle Linux 9 servers, hardware token login

is not enabled by default and must be enabled in the system settings.</xccdf-1.2:description>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smartcard_drivers" type="string" interactive="true">
                  <xccdf-1.2:title>OpenSC Smart Card Drivers</xccdf-1.2:title>
                  <xccdf-1.2:description>Choose the Smart Card Driver in use by your organization.
<html:br/>For DoD, choose the <html:code>cac</html:code> driver.
<html:br/>If your driver is not listed and you don't want to use the
<html:code>default</html:code> driver, use the <html:code>other</html:code> option and
manually specify your driver.</xccdf-1.2:description>
                  <xccdf-1.2:value>default</xccdf-1.2:value>
                  <xccdf-1.2:value selector="acos5">acos5</xccdf-1.2:value>
                  <xccdf-1.2:value selector="akis">akis</xccdf-1.2:value>
                  <xccdf-1.2:value selector="asepcos">asepcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="atrust-acos">atrust-acos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="authentic">authentic</xccdf-1.2:value>
                  <xccdf-1.2:value selector="belpic">belpic</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cac">cac</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cardos">cardos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="coolkey">coolkey</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cyberflex">cyberflex</xccdf-1.2:value>
                  <xccdf-1.2:value selector="dnie">dnie</xccdf-1.2:value>
                  <xccdf-1.2:value selector="entersafe">entersafe</xccdf-1.2:value>
                  <xccdf-1.2:value selector="epass2003">epass2003</xccdf-1.2:value>
                  <xccdf-1.2:value selector="flex">flex</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gemsafeV1">gemsafeV1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gids">gids</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gpk">gpk</xccdf-1.2:value>
                  <xccdf-1.2:value selector="iasecc">iasecc</xccdf-1.2:value>
                  <xccdf-1.2:value selector="incrypto34">incrypto34</xccdf-1.2:value>
                  <xccdf-1.2:value selector="isoApplet">isoApplet</xccdf-1.2:value>
                  <xccdf-1.2:value selector="itacns">itacns</xccdf-1.2:value>
                  <xccdf-1.2:value selector="jpki">jpki</xccdf-1.2:value>
                  <xccdf-1.2:value selector="MaskTech">MaskTech</xccdf-1.2:value>
                  <xccdf-1.2:value selector="mcrd">mcrd</xccdf-1.2:value>
                  <xccdf-1.2:value selector="muscle">muscle</xccdf-1.2:value>
                  <xccdf-1.2:value selector="myeid">myeid</xccdf-1.2:value>
                  <xccdf-1.2:value selector="npa">npa</xccdf-1.2:value>
                  <xccdf-1.2:value selector="oberthur">oberthur</xccdf-1.2:value>
                  <xccdf-1.2:value selector="openpgp">openpgp</xccdf-1.2:value>
                  <xccdf-1.2:value selector="other">None</xccdf-1.2:value>
                  <xccdf-1.2:value selector="PIV-II">PIV-II</xccdf-1.2:value>
                  <xccdf-1.2:value selector="rutoken_ecp">rutoken_ecp</xccdf-1.2:value>
                  <xccdf-1.2:value selector="rutoken">rutoken</xccdf-1.2:value>
                  <xccdf-1.2:value selector="sc-hsm">sc-hsm</xccdf-1.2:value>
                  <xccdf-1.2:value selector="setcos">setcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="starcos">starcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="tcos">tcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="westcos">westcos</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_opensc_installed" severity="medium">
                  <xccdf-1.2:title>Install the opensc Package For Multifactor Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description>
The <html:code>opensc</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install opensc</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000400</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271515r1091257_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/>
          <html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "opensc" ; then
    yum install -y "opensc"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000400
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_opensc_installed

- name: Ensure opensc is installed
  package:
    name: opensc
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000400
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_opensc_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_opensc

class install_opensc {
  package { 'opensc':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_opensc_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=opensc
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_opensc_installed">
[[packages]]
name = "opensc"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_opensc_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_opensc_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" severity="medium">
                  <xccdf-1.2:title>Install the pcsc-lite package</xccdf-1.2:title>
                  <xccdf-1.2:description>The <html:code>pcsc-lite</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install pcsc-lite</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000390</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271514r1091254_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>The pcsc-lite package must be installed if it is to be available for
multifactor authentication using smartcards.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "pcsc-lite" ; then
    yum install -y "pcsc-lite"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000390
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_pcsc-lite_installed

- name: Ensure pcsc-lite is installed
  package:
    name: pcsc-lite
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000390
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_pcsc-lite_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_pcsc-lite

class install_pcsc-lite {
  package { 'pcsc-lite':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_pcsc-lite_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=pcsc-lite
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_pcsc-lite_installed">
[[packages]]
name = "pcsc-lite"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_pcsc-lite_installed:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_install_smartcard_packages" severity="medium">
                  <xccdf-1.2:title>Install Smart Card Packages For Multifactor Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description>Configure the operating system to implement multifactor authentication by
installing the required package with the following command:

The <html:code>openssl-pkcs11</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install openssl-pkcs11</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00161</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000270</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271491r1091185_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/>
          <html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#not_s390x_arch"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ); }; then

if ! rpm -q --quiet "openssl-pkcs11" ; then
    yum install -y "openssl-pkcs11"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000270
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.3
  - enable_strategy
  - install_smartcard_packages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure openssl-pkcs11 is installed
  package:
    name: openssl-pkcs11
    state: present
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture != "s390x"
  tags:
  - DISA-STIG-OL09-00-000270
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.3
  - enable_strategy
  - install_smartcard_packages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openssl-pkcs11

class install_openssl-pkcs11 {
  package { 'openssl-pkcs11':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="install_smartcard_packages" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openssl-pkcs11
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="install_smartcard_packages">
[[packages]]
name = "openssl-pkcs11"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-install_smartcard_packages:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-install_smartcard_packages_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" severity="medium">
                  <xccdf-1.2:title>Enable the pcscd Service</xccdf-1.2:title>
                  <xccdf-1.2:description>
The <html:code>pcscd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable pcscd.service</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271516r1091260_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/>
          <html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_pcscd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'pcscd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'pcscd.service'
fi
"$SYSTEMCTL_EXEC" enable 'pcscd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_pcscd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000401
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - NIST-800-53-IA-2(11)
  - NIST-800-53-IA-2(2)
  - NIST-800-53-IA-2(3)
  - NIST-800-53-IA-2(4)
  - NIST-800-53-IA-2(6)
  - NIST-800-53-IA-2(7)
  - PCI-DSS-Req-8.3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_pcscd_enabled

- name: Enable service pcscd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Start service pcscd
    systemd:
      name: pcscd
      state: started
      masked: 'no'
    when:
    - '"pcsc-lite" in ansible_facts.packages'

  - name: Enable service pcscd
    ansible.builtin.command:
      cmd: systemctl enable pcscd
    when:
    - '"pcsc-lite" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000401
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - NIST-800-53-IA-2(11)
  - NIST-800-53-IA-2(2)
  - NIST-800-53-IA-2(3)
  - NIST-800-53-IA-2(4)
  - NIST-800-53-IA-2(6)
  - NIST-800-53-IA-2(7)
  - PCI-DSS-Req-8.3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_pcscd_enabled
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_pcscd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_pcscd

class enable_pcscd {
  service {'pcscd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_pcscd_enabled">
[customizations.services]
enabled = ["pcscd"]
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_pcscd_enabled:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" severity="medium">
                  <xccdf-1.2:title>Configure opensc Smart Card Drivers</xccdf-1.2:title>
                  <xccdf-1.2:description>The OpenSC smart card tool can auto-detect smart card drivers; however,
setting the smart card drivers in use by your organization helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To configure the OpenSC driver, edit the <html:code>/etc/opensc.conf</html:code>
and add the following line into the file in the <html:code>app default</html:code> block,
so it will look like:

<html:pre>
app default {
   ...
   card_drivers = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;
}
</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001941</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004045</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000940</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271610r1091542_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Configuring the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_opensc_card_drivers" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_smartcard_drivers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>'


OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:card_drivers:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_opensc_card_drivers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000940
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - NIST-800-53-IA-2(11)
  - NIST-800-53-IA-2(2)
  - NIST-800-53-IA-2(3)
  - NIST-800-53-IA-2(4)
  - NIST-800-53-IA-2(6)
  - NIST-800-53-IA-2(7)
  - PCI-DSS-Req-8.3
  - configure_opensc_card_drivers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_cd
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000940
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - NIST-800-53-IA-2(11)
  - NIST-800-53-IA-2(2)
  - NIST-800-53-IA-2(3)
  - NIST-800-53-IA-2(4)
  - NIST-800-53-IA-2(6)
  - NIST-800-53-IA-2(7)
  - PCI-DSS-Req-8.3
  - configure_opensc_card_drivers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure smartcard driver block
  block:

  - name: Check if card_drivers is defined
    command: /usr/bin/opensc-tool -G app:default:card_drivers
    changed_when: false
    register: card_drivers

  - name: Configure opensc Smart Card Drivers
    command: |
      /usr/bin/opensc-tool -S app:default:card_drivers:{{ var_smartcard_drivers }}
    when:
    - card_drivers.stdout != var_smartcard_drivers
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - opensc_conf_cd.stat.exists
  tags:
  - DISA-STIG-OL09-00-000940
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - NIST-800-53-IA-2(11)
  - NIST-800-53-IA-2(2)
  - NIST-800-53-IA-2(3)
  - NIST-800-53-IA-2(4)
  - NIST-800-53-IA-2(6)
  - NIST-800-53-IA-2(7)
  - PCI-DSS-Req-8.3
  - configure_opensc_card_drivers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_opensc_card_drivers:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-restrictions">
            <xccdf-1.2:title>Protect Accounts by Restricting Password-Based Login</xccdf-1.2:title>
            <xccdf-1.2:description>Conventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the <html:code>/etc/passwd</html:code> and
<html:code>/etc/shadow</html:code> files. Password-based login is vulnerable to
guessing of weak passwords, and to sniffing and man-in-the-middle
attacks against passwords entered over a network or at an insecure
console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex" type="string" operator="pattern match" interactive="true">
              <xccdf-1.2:title>Accounts Authorized Local Users on the Operating System</xccdf-1.2:title>
              <xccdf-1.2:description>List the user accounts that are authorized locally on the operating system. This list
includes both users requried by the operating system and by the installed applications.
Depending on the Operating System distribution, version, software groups and applications,
the user list is different and can be customized with scap-workbench.
OVAL regular expression is used for the user list.
The list starts with '^' and ends with '$' so that it matches exactly the
username, not any string that includes the username. Users are separated with '|'.
For example, three users: bin, oracle and sapadm are allowed, then the list is
<html:code>^(bin|oracle|sapadm)$</html:code>. The user <html:code>root</html:code> is the only user that is hard coded
in OVAL that is always allowed on the operating system.</xccdf-1.2:description>
              <xccdf-1.2:value selector="ol7">^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="ol8">^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="ol9">^(abrt|adm|avahi|bin|chrony|clevis|cockpit-ws|cockpit-wsinstance|colord|daemon|dbus|dnsmasq|fapolicyd|flatpak|ftp|games|gdm|geoclue|gluster|gnome-initial-setup|halt|libstoragemgmt|lp|mail|nfsnobody|nobody|ntp|operator|oprofile|oracle|pcp|pegasus|pipewire|polkitd|postfix|pulse|qemu|radvd|rngd|root|rpc|rpcuser|rtkit|saned|saslauth|setroubleshoot|shutdown|sshd|sssd|sync|systemd-bus-proxy|systemd-coredump|systemd-network|systemd-oom|systemd-resolve|tcpdump|tss|unbound|usbmuxd$|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="ol7forsap">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="rhel8">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="rhel9">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|tss|systemd-coredump|dbus|polkitd|avahi|colord|rtkit|pipewire|clevis|sssd|geoclue|flatpak|setroubleshoot|libstoragemgmt|systemd-oom|gdm|cockpit-ws|cockpit-wsinstance|gnome-initial-setup|sshd|chrony|dnsmasq|tcpdump|admin)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="sle12">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="sle15">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc|messagebus|nscd|flatpak|srvGeoClue|tftp|wsdd|dnsmasq|usbmux|brltty)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="slmicro5">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd|man|systemd-timesync|scard|hacluster|statd|at|dockremap|vnc|messagebus|nscd|flatpak|srvGeoClue|tftp|wsdd|dnsmasq|usbmux|brltty|salt|cockpit-ws|cockpit-wsinstance)$</xccdf-1.2:value>
              <xccdf-1.2:value>^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|tss|systemd-coredump|dbus|polkitd|avahi|colord|rtkit|pipewire|clevis|sssd|geoclue|flatpak|setroubleshoot|libstoragemgmt|systemd-oom|gdm|cockpit-ws|cockpit-wsinstance|gnome-initial-setup|sshd|chrony|dnsmasq|tcpdump|admin)$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_unique_id" severity="medium">
              <xccdf-1.2:title>Ensure All Accounts on the System Have Unique User IDs</xccdf-1.2:title>
              <xccdf-1.2:description>Change user IDs (UIDs), or delete accounts, so each has a unique name.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to unique requirements of each
system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000804</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000121-GPOS-00062</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003001</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271832r1092208_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_unique_id:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_unique_id_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_authorized_local_users" severity="medium">
              <xccdf-1.2:title>Only Authorized Local User Accounts Exist on Operating System</xccdf-1.2:title>
              <xccdf-1.2:description>Enterprise Application tends to use the server or virtual machine exclusively.
Besides the default operating system user, there should be only authorized local
users required by the installed software groups and applications that exist on
the operating system. The authorized user list can be customized in the refine
value variable <html:code>var_accounts_authorized_local_users_regex</html:code>.
OVAL regular expression is used for the user list.
Configure the system so all accounts on the system are assigned to an active system,
application, or user account. Remove accounts that do not support approved system
activities or that allow for a normal user to perform administrative-level actions.
To remove unauthorized system accounts, use the following command:
<html:pre>$ sudo userdel <html:i>unauthorized_user</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to the unique
requirements of each system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002501</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271770r1092022_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Accounts providing no operational purpose provide additional opportunities for
system compromise. Unnecessary accounts include user accounts for individuals not
requiring access to the system and application accounts for applications not installed
on the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_authorized_local_users_regex:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_authorized_local_users:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_authorized_local_users_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_group_unique_id" severity="medium">
              <xccdf-1.2:title>Ensure All Groups on the System Have Unique Group ID</xccdf-1.2:title>
              <xccdf-1.2:description>Change the group name or delete groups, so each has a unique id.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to the unique requirements of each system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271835r1092217_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-group_unique_id:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-group_unique_id_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_account_expiration">
              <xccdf-1.2:title>Set Account Expiration Parameters</xccdf-1.2:title>
              <xccdf-1.2:description>Accounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting <html:code><html:i>NUM_DAYS</html:i></html:code> and <html:code><html:i>USER</html:i></html:code> appropriately:
<html:pre>$ sudo chage -I <html:i>NUM_DAYS USER</html:i>
        </html:pre>
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the
<html:code>-E</html:code> option.
The file <html:code>/etc/default/useradd</html:code> controls
default settings for all newly-created accounts created with the system's
normal command line utilities.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_account_disable_inactivity" type="number">
                <xccdf-1.2:title>number of days after the last login of the user when the user will be locked out</xccdf-1.2:title>
                <xccdf-1.2:description>'This option is specific for the auth or account phase. It specifies the number of days after
the last login of the user when the user will be locked out by the pam_lastlog module.'</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="30">30</xccdf-1.2:value>
                <xccdf-1.2:value selector="35">35</xccdf-1.2:value>
                <xccdf-1.2:value selector="40">40</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value>35</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" type="number">
                <xccdf-1.2:title>number of days after a password expires until the account is permanently disabled</xccdf-1.2:title>
                <xccdf-1.2:description>The number of days to wait after a password expires, until the account will be permanently disabled.</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="30">30</xccdf-1.2:value>
                <xccdf-1.2:value selector="35">35</xccdf-1.2:value>
                <xccdf-1.2:value selector="40">40</xccdf-1.2:value>
                <xccdf-1.2:value selector="45">45</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value>35</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_disable_inactivity_password_auth" severity="medium">
                <xccdf-1.2:title>Set Account Expiration Following Inactivity in password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Verify the account identifiers (individuals, groups, roles, and devices) are disabled after
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_inactivity" use="legacy"/> or less days of inactivity by
checking the account inactivity value with the following command:
<html:pre>grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth

auth required pam_lastlog.so inactive=35
auth sufficient pam_unix.so</html:pre>
The line with the inactive parameter should be placed before <html:code>pam_unix.so</html:code> module as in
the example output.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000795</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Inactive identifiers pose a risk to systems and applications because attackers may exploit an
inactive identifier and potentially obtain undetected access to the system. Owners of inactive
accounts will not notice if unauthorized access to their user account has been obtained.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_disable_inactivity_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

PAM_FILE_PATH="/etc/pam.d/password-auth"
if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
    echo "
    authselect integrity check failed. Remediation aborted!
    This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
    It is not recommended to manually edit the PAM files when authselect tool is available.
    In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    exit 1
    fi
    CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
    # If not already in use, a custom profile is created preserving the enabled features.
    if [[ ! $CURRENT_PROFILE == custom/* ]]; then
        ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
        # The "local" profile does not contain essential security features required by multiple Benchmarks.
        # If currently used, it is replaced by "sssd", which is the best option in this case.
        if [[ $CURRENT_PROFILE == local ]]; then
            CURRENT_PROFILE="sssd"
        fi
        authselect create-profile hardening -b $CURRENT_PROFILE
        CURRENT_PROFILE="custom/hardening"
        
        authselect apply-changes -b --backup=before-hardening-custom-profile
        authselect select $CURRENT_PROFILE
        for feature in $ENABLED_FEATURES; do
            authselect enable-feature $feature;
        done
        
        authselect apply-changes -b --backup=after-hardening-custom-profile
    fi
    PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
    PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"
    authselect apply-changes -b --backup=before-hardening-pam_lastlog.so-inactive.backup
fi


if ! grep -qP "^\s*auth\s+required\s+pam_lastlog.so\s*.*" "$PAM_FILE_PATH"; then
    # Line matching group + control + module was not found. Check group + module.
    if [ "$(grep -cP '^\s*auth\s+.*\s+pam_lastlog.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
        # The control is updated only if one single line matches.
        sed -i -E --follow-symlinks "s/^(\s*auth\s+).*(\bpam_lastlog.so.*)/\1required \2/" "$PAM_FILE_PATH"
    else
        echo "auth    required    pam_lastlog.so" &gt;&gt; "$PAM_FILE_PATH"
    fi
fi
# Check the option
if ! grep -qP "^\s*auth\s+required\s+pam_lastlog.so\s*.*\sinactive\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "/\s*auth\s+required\s+pam_lastlog.so.*/ s/$/ inactive=35/" "$PAM_FILE_PATH"
else
    sed -i -E --follow-symlinks "s/(\s*auth\s+required\s+pam_lastlog.so\s+.*)(inactive=)[[:alnum:]]+\s*(.*)/\1\235 \3/" "$PAM_FILE_PATH"
fi

if ! grep -qP "^\s*auth\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
    # Line matching group + control + module was not found. Check group + module.
    if [ "$(grep -cP '^\s*auth\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
        # The control is updated only if one single line matches.
        sed -i -E --follow-symlinks "s/^(\s*auth\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
    else
        LAST_MATCH_LINE=$(grep -nP "^\s*auth.*required.*pam_lastlog\.so.*" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
        if [ ! -z $LAST_MATCH_LINE ]; then
            sed -i --follow-symlinks $LAST_MATCH_LINE" a auth     sufficient    pam_unix.so" "$PAM_FILE_PATH"
        else
            echo "auth    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
fi
# Ensure pam_unix.so is configured after pam_lastlog.so
if ! grep -Pz \
    "auth\s*required\s*pam_lastlog\.so[^#]*inactive=35[\s\S]*\n\s*auth\s*sufficient\s*pam_unix\.so"\
    "$PAM_FILE_PATH"  ; then
    readarray -t pam_lastlog_lines &lt;&lt;&lt; "$(grep -oP '^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*' $PAM_FILE_PATH)"
    sed -i "/^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*/d" "$PAM_FILE_PATH"
    for line in "${pam_lastlog_lines[@]}"; do
        sed -i "/^\s*auth.*pam_unix\.so.*/i$line" "$PAM_FILE_PATH"
    done
fi
if [ -f /usr/bin/authselect ]; then
    authselect apply-changes -b --backup=after-hardening-pam_lastlog.so-inactive.backup
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_disable_inactivity_password_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_disable_inactivity_password_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_disable_inactivity_system_auth" severity="medium">
                <xccdf-1.2:title>Set Account Expiration Following Inactivity in system-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Verify the account identifiers (individuals, groups, roles, and devices) are disabled after
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_inactivity" use="legacy"/> or less days of inactivity by
checking the account inactivity value with the following command:
<html:pre>grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth

auth required pam_lastlog.so inactive=35
auth sufficient pam_unix.so</html:pre>
The line with the inactive parameter should be placed before <html:code>pam_unix.so</html:code> module as in
the example output.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000795</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Inactive identifiers pose a risk to systems and applications because attackers may exploit an
inactive identifier and potentially obtain undetected access to the system. Owners of inactive
accounts will not notice if unauthorized access to their user account has been obtained.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_disable_inactivity_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

PAM_FILE_PATH="/etc/pam.d/system-auth"
if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
    echo "
    authselect integrity check failed. Remediation aborted!
    This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
    It is not recommended to manually edit the PAM files when authselect tool is available.
    In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    exit 1
    fi
    CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
    # If not already in use, a custom profile is created preserving the enabled features.
    if [[ ! $CURRENT_PROFILE == custom/* ]]; then
        ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
        # The "local" profile does not contain essential security features required by multiple Benchmarks.
        # If currently used, it is replaced by "sssd", which is the best option in this case.
        if [[ $CURRENT_PROFILE == local ]]; then
            CURRENT_PROFILE="sssd"
        fi
        authselect create-profile hardening -b $CURRENT_PROFILE
        CURRENT_PROFILE="custom/hardening"
        
        authselect apply-changes -b --backup=before-hardening-custom-profile
        authselect select $CURRENT_PROFILE
        for feature in $ENABLED_FEATURES; do
            authselect enable-feature $feature;
        done
        
        authselect apply-changes -b --backup=after-hardening-custom-profile
    fi
    PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
    PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"
    authselect apply-changes -b --backup=before-hardening-pam_lastlog.so-inactive.backup
fi


if ! grep -qP "^\s*auth\s+required\s+pam_lastlog.so\s*.*" "$PAM_FILE_PATH"; then
    # Line matching group + control + module was not found. Check group + module.
    if [ "$(grep -cP '^\s*auth\s+.*\s+pam_lastlog.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
        # The control is updated only if one single line matches.
        sed -i -E --follow-symlinks "s/^(\s*auth\s+).*(\bpam_lastlog.so.*)/\1required \2/" "$PAM_FILE_PATH"
    else
        echo "auth    required    pam_lastlog.so" &gt;&gt; "$PAM_FILE_PATH"
    fi
fi
# Check the option
if ! grep -qP "^\s*auth\s+required\s+pam_lastlog.so\s*.*\sinactive\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "/\s*auth\s+required\s+pam_lastlog.so.*/ s/$/ inactive=35/" "$PAM_FILE_PATH"
else
    sed -i -E --follow-symlinks "s/(\s*auth\s+required\s+pam_lastlog.so\s+.*)(inactive=)[[:alnum:]]+\s*(.*)/\1\235 \3/" "$PAM_FILE_PATH"
fi

if ! grep -qP "^\s*auth\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
    # Line matching group + control + module was not found. Check group + module.
    if [ "$(grep -cP '^\s*auth\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
        # The control is updated only if one single line matches.
        sed -i -E --follow-symlinks "s/^(\s*auth\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
    else
        LAST_MATCH_LINE=$(grep -nP "^\s*auth.*required.*pam_lastlog\.so.*" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
        if [ ! -z $LAST_MATCH_LINE ]; then
            sed -i --follow-symlinks $LAST_MATCH_LINE" a auth     sufficient    pam_unix.so" "$PAM_FILE_PATH"
        else
            echo "auth    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
fi
# Ensure pam_unix.so is configured after pam_lastlog.so
if ! grep -Pz \
    "auth\s*required\s*pam_lastlog\.so[^#]*inactive=35[\s\S]*\n\s*auth\s*sufficient\s*pam_unix\.so"\
    "$PAM_FILE_PATH"  ; then
    readarray -t pam_lastlog_lines &lt;&lt;&lt; "$(grep -oP '^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*' $PAM_FILE_PATH)"
    sed -i "/^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*/d" "$PAM_FILE_PATH"
    for line in "${pam_lastlog_lines[@]}"; do
        sed -i "/^\s*auth.*pam_unix\.so.*/i$line" "$PAM_FILE_PATH"
    done
fi
if [ -f /usr/bin/authselect ]; then
    authselect apply-changes -b --backup=after-hardening-pam_lastlog.so-inactive.backup
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_disable_inactivity_system_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_disable_inactivity_system_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" severity="medium">
                <xccdf-1.2:title>Set Account Expiration Following Inactivity</xccdf-1.2:title>
                <xccdf-1.2:description>To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in <html:code>/etc/default/useradd</html:code>:
<html:pre>INACTIVE=<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:i>
         </html:pre>
If a password is currently on the verge of expiration, then
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code>
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code> day(s) could
elapse until the account would be automatically disabled. See the
<html:code>useradd</html:code> man page for more information.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003628</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003627</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271849r1092259_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system.
Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.
Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="account_disable_post_pw_expiration"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_account_disable_post_pw_expiration='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^INACTIVE")

# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_account_disable_post_pw_expiration"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^INACTIVE\\&gt;" "/etc/default/useradd"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^INACTIVE\\&gt;.*/$escaped_formatted_output/gi" "/etc/default/useradd"
else
    if [[ -s "/etc/default/useradd" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/default/useradd" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/default/useradd"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/default/useradd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="account_disable_post_pw_expiration" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - DISA-STIG-OL09-00-003065
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - account_disable_post_pw_expiration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  lineinfile:
    create: true
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: INACTIVE={{ var_account_disable_post_pw_expiration }}
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - DISA-STIG-OL09-00-003065
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - account_disable_post_pw_expiration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_disable_post_pw_expiration:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_temp_expire_date" severity="medium">
                <xccdf-1.2:title>Assign Expiration Date to Temporary Accounts</xccdf-1.2:title>
                <xccdf-1.2:description>Temporary accounts are established as part of normal account activation
procedures when there is a need for short-term accounts. In the event
temporary accounts are required, configure the system to
terminate them after a documented time period. For every temporary account, run the following command to set an expiration date on
it, substituting <html:code><html:i>USER</html:i></html:code> and <html:code><html:i>YYYY-MM-DD</html:i></html:code>
appropriately:
<html:pre>$ sudo chage -E <html:i>YYYY-MM-DD USER</html:i>
         </html:pre>
         <html:code><html:i>YYYY-MM-DD</html:i></html:code> indicates the documented expiration date for the
account. For U.S. Government systems, the operating system must be
configured to automatically terminate these types of accounts after a
period of 72 hours.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000016</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001682</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000123-GPOS-00064</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000002-GPOS-00002</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003030</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271843r1094969_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If temporary user accounts remain active when no longer needed or for
an excessive period, these accounts may be used to gain unauthorized access.
To mitigate this risk, automated termination of all temporary accounts
must be set upon account creation.
<html:br/>
        </xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_unique_name" severity="medium">
                <xccdf-1.2:title>Ensure All Accounts on the System Have Unique Names</xccdf-1.2:title>
                <xccdf-1.2:description>Ensure accounts on the system have unique names.

To ensure all accounts have unique names, run the following command:
<html:pre>$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</html:pre>
If a username is returned, change or delete the username.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000804</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unique usernames allow for accountability on the system.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-account_unique_name:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_unique_name_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_account_use_centralized_automated_auth" severity="medium">
                <xccdf-1.2:title>Use Centralized and Automated Authentication</xccdf-1.2:title>
                <xccdf-1.2:description>Implement an automated system for managing user accounts that minimizes the
risk of errors, either intentional or deliberate. This system
should integrate with an existing enterprise user management system, such as
one based on Identity Management tools such as Active Directory, Kerberos,
Directory Server, etc.</xccdf-1.2:description>
                <xccdf-1.2:rationale>A comprehensive account management process that includes automation helps to
ensure the accounts designated as requiring attention are consistently and
promptly addressed. Enterprise environments make user account management
challenging and complex. A user management process requiring administrators to
manually address account management functions adds risk of potential
oversight.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_expiration">
              <xccdf-1.2:title>Set Password Expiration Parameters</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/etc/login.defs</html:code> controls several
password-related settings. Programs such as <html:code>passwd</html:code>,
<html:code>su</html:code>, and
<html:code>login</html:code> consult <html:code>/etc/login.defs</html:code> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <html:code>login.defs(5)</html:code> for more information.
<html:br/>
        <html:br/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<html:code>PASS_MAX_DAYS</html:code> and apply it to existing accounts with the
<html:code>-M</html:code> flag.
<html:br/>
        <html:br/>
The <html:code>PASS_MIN_DAYS</html:code> (<html:code>-m</html:code>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <html:code>PASS_WARN_AGE</html:code> (<html:code>-W</html:code>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<html:br/>
        <html:br/>
For example, for each existing human user <html:i>USER</html:i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<html:pre>$ sudo chage -M 180 -m 7 -W 7 USER</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" type="number">
                <xccdf-1.2:title>maximum password age</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum age of password in days</xccdf-1.2:description>
                <xccdf-1.2:value selector="365">365</xccdf-1.2:value>
                <xccdf-1.2:value selector="120">120</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="45">45</xccdf-1.2:value>
                <xccdf-1.2:value>60</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_root" type="number">
                <xccdf-1.2:title>Maximum Root Password Age</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum age of password in days for the root account</xccdf-1.2:description>
                <xccdf-1.2:value selector="365">365</xccdf-1.2:value>
                <xccdf-1.2:value>99999</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" type="number">
                <xccdf-1.2:title>minimum password age</xccdf-1.2:title>
                <xccdf-1.2:description>Minimum age of password in days</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value>7</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" type="number">
                <xccdf-1.2:title>minimum password length</xccdf-1.2:title>
                <xccdf-1.2:description>Minimum number of characters in password</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This will only check new passwords</xccdf-1.2:warning>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="12">12</xccdf-1.2:value>
                <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                <xccdf-1.2:value selector="17">17</xccdf-1.2:value>
                <xccdf-1.2:value selector="18">18</xccdf-1.2:value>
                <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value>15</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" type="number">
                <xccdf-1.2:title>warning days before password expires</xccdf-1.2:title>
                <xccdf-1.2:description>The number of days' warning given before a password expires.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value>7</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Maximum Age</xccdf-1.2:title>
                <xccdf-1.2:description>To specify password maximum age for new accounts,
edit the file <html:code>/etc/login.defs</html:code>
and add or correct the following line:
<html:pre>PASS_MAX_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
         </html:pre>
A value of 180 days is sufficient for many environments.
The DoD requirement is 60.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001095</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271631r1091605_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
<html:br/>
         <html:br/>
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_maximum_age_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_maximum_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_MAX_DAYS")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_maximum_age_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_MAX_DAYS\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_MAX_DAYS\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_maximum_age_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1
  - DISA-STIG-OL09-00-001095
  - NIST-800-171-3.5.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_maximum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Maximum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1
  - DISA-STIG-OL09-00-001095
  - NIST-800-171-3.5.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_maximum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_maximum_age_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Minimum Age</xccdf-1.2:title>
                <xccdf-1.2:description>To specify password minimum age for new accounts,
edit the file <html:code>/etc/login.defs</html:code>
and add or correct the following line:
<html:pre>PASS_MIN_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
         </html:pre>
A value of 1 day is considered sufficient for many
environments. The DoD requirement is 1.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000075-GPOS-00043</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password,
then the password could be repeatedly changed in a short period of time to
defeat the organization's policy regarding password reuse.
<html:br/>
         <html:br/>
Setting the minimum password age protects against users cycling back to a
favorite password after satisfying the password reuse requirement.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_minimum_age_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_minimum_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_MIN_DAYS")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_minimum_age_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_MIN_DAYS\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_MIN_DAYS\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_minimum_age_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_minimum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MIN_DAYS
    line: PASS_MIN_DAYS {{ var_accounts_minimum_age_login_defs }}
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_minimum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_minimum_age_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Minimum Length in login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>To specify password length requirements for new accounts, edit the file
<html:code>/etc/login.defs</html:code> and add or correct the following line:
<html:pre>PASS_MIN_LEN <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>
         </html:pre>
         <html:br/>
         <html:br/>
The DoD requirement is <html:code>15</html:code>.
The FISMA requirement is <html:code>12</html:code>.
The profile requirement is
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/></html:code>.
If a program consults <html:code>/etc/login.defs</html:code> and also another PAM module
(such as <html:code>pam_pwquality</html:code>) during a password change operation, then
the most restrictive must be satisfied. See PAM section for more
information about enforcing password quality requirements.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001105</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271633r1091611_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Requiring a minimum password length makes password
cracking attacks more difficult by ensuring a larger
search space. However, any security benefit from an onerous requirement
must be carefully weighed against usability problems, support costs, or counterproductive
behavior that may result.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_minlen_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_password_minlen_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_MIN_LEN")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_password_minlen_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_MIN_LEN\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_MIN_LEN\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_minlen_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1
  - DISA-STIG-OL09-00-001105
  - NIST-800-171-3.5.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(f)
  - accounts_password_minlen_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_password_minlen_login_defs # promote to variable
  set_fact:
    var_accounts_password_minlen_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Length in login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_MIN_LEN *[0-9]*
    state: present
    line: PASS_MIN_LEN        {{ var_accounts_password_minlen_login_defs }}
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1
  - DISA-STIG-OL09-00-001105
  - NIST-800-171-3.5.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(f)
  - accounts_password_minlen_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_password_minlen_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_minlen_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" severity="medium">
                <xccdf-1.2:title>Set Existing Passwords Maximum Age</xccdf-1.2:title>
                <xccdf-1.2:description>Configure non-compliant accounts to enforce a <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>-day maximum password lifetime
restriction by running the following command:
<html:pre>$ sudo chage -M <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
          <html:i>USER</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271632r1091608_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any password, no matter how complex, can eventually be cracked. Therefore,
passwords need to be changed periodically. If the operating system does
not limit the lifetime of passwords and force users to change their
passwords, there is the risk that the operating system passwords could be
compromised.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_set_max_life_existing" complexity="low" disruption="low" reboot="false" strategy="restrict">
var_accounts_maximum_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>'


while IFS= read -r i; do
    
    chage -M $var_accounts_maximum_age_login_defs $i

done &lt;   &lt;(awk -v var="$var_accounts_maximum_age_login_defs" -F: '(/^[^:]+:[^!*]/ &amp;&amp; ($5 &gt; var || $5 == "")) {print $1}' /etc/shadow)
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_set_max_life_existing" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Collect users with not correct maximum time period between password changes
  ansible.builtin.command:
    cmd: awk -F':' '(/^[^:]+:[^!*]/ &amp;&amp; ($5 &gt; {{ var_accounts_maximum_age_login_defs
      }} || $5 == "")) {print $1}' /etc/shadow
  register: user_names
  tags:
  - DISA-STIG-OL09-00-001100
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_max_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Change the maximum time period between password changes
  ansible.builtin.user:
    user: '{{ item }}'
    password_expire_max: '{{ var_accounts_maximum_age_login_defs }}'
  with_items: '{{ user_names.stdout_lines }}'
  when: user_names.stdout_lines | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-001100
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_max_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_set_max_life_existing:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_set_max_life_existing_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_root" severity="medium">
                <xccdf-1.2:title>Set Root Account Password Maximum Age</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the root account to enforce a <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_root" use="legacy"/>-day maximum password lifetime restriction by running the following command:
<html:pre>$ sudo chage -M <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_root" use="legacy"/> root</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any password, no matter how complex, can eventually be cracked. Therefore,
passwords need to be changed periodically. If the operating system does
not limit the lifetime of passwords and force users to change their
passwords, there is the risk that the operating system passwords could be
compromised.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_maximum_age_root:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_root"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_set_max_life_root:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_set_max_life_root_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" severity="medium">
                <xccdf-1.2:title>Set Existing Passwords Minimum Age</xccdf-1.2:title>
                <xccdf-1.2:description>Configure non-compliant accounts to enforce a 24 hours/1 day minimum password
lifetime by running the following command:
<html:pre>$ sudo chage -m 1 <html:i>USER</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004066</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000075-GPOS-00043</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001090</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001085</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271630r1091602_rule</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271629r1091599_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password, the
password could be repeatedly changed in a short period of time to defeat the
organization's policy regarding password reuse.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_set_min_life_existing" complexity="low" disruption="low" reboot="false" strategy="restrict">
var_accounts_minimum_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>'


while IFS= read -r i; do
    
    chage -m $var_accounts_minimum_age_login_defs $i

done &lt;   &lt;(awk -v var="$var_accounts_minimum_age_login_defs" -F: '(/^[^:]+:[^!*]/ &amp;&amp; ($4 &lt; var || $4 == "")) {print $1}' /etc/shadow)
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_set_min_life_existing" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Collect users with not correct minimum time period between password changes
  command: |
    awk -F':' '(/^[^:]+:[^!*]/ &amp;&amp; ($4 &lt; {{ var_accounts_minimum_age_login_defs }} || $4 == "")) {print $1}' /etc/shadow
  register: user_names
  tags:
  - DISA-STIG-OL09-00-001085
  - DISA-STIG-OL09-00-001090
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_password_set_min_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Change the minimum time period between password changes
  command: |
    chage -m {{ var_accounts_minimum_age_login_defs }} {{ item }}
  with_items: '{{ user_names.stdout_lines }}'
  when: user_names.stdout_lines | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-001085
  - DISA-STIG-OL09-00-001090
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_password_set_min_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_set_min_life_existing:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_set_min_life_existing_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing" severity="medium">
                <xccdf-1.2:title>Set Existing Passwords Warning Age</xccdf-1.2:title>
                <xccdf-1.2:description>To configure how many days prior to password expiration that a warning will be issued to
users, run the command:
<html:pre>$ sudo chage --warndays <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
          <html:i>USER</html:i>
         </html:pre>
The DoD requirement is 7, and CIS recommendation is no less than 7 days.
This profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000198</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Providing an advance warning that a password will be expiring gives users
time to think of a secure password. Users caught unaware may choose a simple
password or write it down where it may be discovered.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_set_warn_age_existing" complexity="low" disruption="low" reboot="false" strategy="configure">
var_accounts_password_warn_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>'


while IFS= read -r i; do
    chage --warndays $var_accounts_password_warn_age_login_defs $i
done &lt;   &lt;(awk -v var="$var_accounts_password_warn_age_login_defs" -F: '(($6 &lt; var || $6 == "") &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow)
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_set_warn_age_existing" complexity="low" disruption="low" reboot="false" strategy="configure">- name: XCCDF Value var_accounts_password_warn_age_login_defs # promote to variable
  set_fact:
    var_accounts_password_warn_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Existing Passwords Warning Age - Collect Users With Incorrect Number of
    Days of Warning Before Password Expires
  ansible.builtin.command:
    cmd: awk -F':' '(($6 &lt; {{ var_accounts_password_warn_age_login_defs }} || $6 ==
      "") &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow
  register: result_pass_warn_age_user_names
  changed_when: false
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_warn_age_existing
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set Existing Passwords Warning Age - Ensure the Number of Days of Warning
    Before Password Expires
  ansible.builtin.command:
    cmd: chage --warndays {{ var_accounts_password_warn_age_login_defs }} {{ item
      }}
  with_items: '{{ result_pass_warn_age_user_names.stdout_lines }}'
  when: result_pass_warn_age_user_names is not skipped and result_pass_warn_age_user_names.stdout_lines
    | length &gt; 0
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_warn_age_existing
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_set_warn_age_existing:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_set_warn_age_existing_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" severity="medium">
                <xccdf-1.2:title>Set Password Warning Age</xccdf-1.2:title>
                <xccdf-1.2:description>To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file <html:code>/etc/login.defs</html:code> and add or correct
 the following line:
<html:pre>PASS_WARN_AGE <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
         </html:pre>
The DoD requirement is 7.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting the password warning age enables users to
make the change at a practical time.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_warn_age_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_password_warn_age_login_defs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_WARN_AGE")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_password_warn_age_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_WARN_AGE\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_WARN_AGE\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_warn_age_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_warn_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_password_warn_age_login_defs # promote to variable
  set_fact:
    var_accounts_password_warn_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Warning Age
  lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_WARN_AGE *[0-9]*
    state: present
    line: PASS_WARN_AGE        {{ var_accounts_password_warn_age_login_defs }}
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_warn_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_warn_age_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing" severity="medium">
                <xccdf-1.2:title>Set existing passwords a period of inactivity before they been locked</xccdf-1.2:title>
                <xccdf-1.2:description>Configure user accounts that have been inactive for over a given period of time
to be automatically disabled by running the following command:
<html:pre>$ sudo chage --inactive 30<html:i>USER</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000017</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000795</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003627</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003628</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Inactive accounts pose a threat to system security since the users are not logging in to
notice failed login attempts or other anomalies.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_set_post_pw_existing" complexity="low" disruption="low" reboot="false" strategy="restrict">
var_account_disable_post_pw_expiration='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>'


while IFS= read -r i; do
    chage --inactive $var_account_disable_post_pw_expiration $i
done &lt;   &lt;(awk -v var="$var_account_disable_post_pw_expiration" -F: '(($7 &gt; var || $7 == "") &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow)
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_set_post_pw_existing" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Collect users with not correct INACTIVE parameter set
  ansible.builtin.command:
    cmd: awk -F':' '(($7 &gt; {{ var_account_disable_post_pw_expiration }} || $7 == "")
      &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow
  register: user_names
  changed_when: false
  tags:
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - accounts_set_post_pw_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Change the period of inactivity
  ansible.builtin.command:
    cmd: chage --inactive {{ var_account_disable_post_pw_expiration }} {{ item }}
  with_items: '{{ user_names.stdout_lines }}'
  when: user_names is not skipped and user_names.stdout_lines | length &gt; 0
  tags:
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - accounts_set_post_pw_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_set_post_pw_existing:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_set_post_pw_existing_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_storage">
              <xccdf-1.2:title>Verify Proper Storage and Existence of Password
Hashes</xccdf-1.2:title>
              <xccdf-1.2:description>By default, password hashes for local accounts are stored
in the second field (colon-separated) in
<html:code>/etc/shadow</html:code>. This file should be readable only by
processes running with root credentials, preventing users from
casually accessing others' password hashes and attempting
to crack them.
However, it remains possible to misconfigure the system
and store password hashes
in world-readable files such as <html:code>/etc/passwd</html:code>, or
to even store passwords themselves in plaintext on the system.
Using system-provided tools for password change/creation
should allow administrators to avoid such misconfiguration.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" type="number">
                <xccdf-1.2:title>Password Hashing algorithm</xccdf-1.2:title>
                <xccdf-1.2:description>Specify the number of rounds for the system password encryption algorithm.
Defines the value set in <html:code>/etc/pam.d/system-auth</html:code> and <html:code>/etc/pam.d/password-auth</html:code>
        </xccdf-1.2:description>
                <xccdf-1.2:value>5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="5000">5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="65536">65536</xccdf-1.2:value>
                <xccdf-1.2:value selector="100000">100000</xccdf-1.2:value>
                <xccdf-1.2:value selector="11">11</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" severity="medium">
                <xccdf-1.2:title>Verify All Account Password Hashes are Shadowed</xccdf-1.2:title>
                <xccdf-1.2:description>If any password hashes are stored in <html:code>/etc/passwd</html:code> (in the second field,
instead of an <html:code>x</html:code> or <html:code>*</html:code>), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1410</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The hashes for all user account passwords should be stored in
the file <html:code>/etc/shadow</html:code> and never in <html:code>/etc/passwd</html:code>,
which is readable by all users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_all_shadowed:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed_sha512" severity="medium">
                <xccdf-1.2:title>Verify All Account Password Hashes are Shadowed with SHA512</xccdf-1.2:title>
                <xccdf-1.2:description>Verify the operating system requires the shadow password suite
configuration be set to encrypt interactive user passwords using a strong
cryptographic hash.
Check that the interactive user account passwords are using a strong
password hash with the following command:
<html:pre>$ sudo cut -d: -f2 /etc/shadow
$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/</html:pre>
Password hashes <html:code>!</html:code> or <html:code>*</html:code> indicate inactive accounts not
available for logon and are not evaluated.
If any interactive user password hash does not begin with <html:code>$6</html:code>,
this is a finding.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1).1(v)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001080</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271628r1091596_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_all_shadowed_sha512:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past" severity="medium">
                <xccdf-1.2:title>Ensure all users last password change date is in the past</xccdf-1.2:title>
                <xccdf-1.2:description>All users should have a password change date in the past.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Automatic remediation is not available, in order to avoid any system disruption.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If a user recorded password change date is in the future then they could
bypass any set password expiration.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_last_change_is_in_past:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_last_change_is_in_past_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth" severity="medium">
                <xccdf-1.2:title>Set number of Password Hashing Rounds - password-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the number or rounds for the password hashing algorithm. This can be
accomplished by using the <html:code>rounds</html:code> option for the <html:code>pam_unix</html:code> PAM module.
<html:br/>
         <html:br/>
In file <html:code>/etc/pam.d/password-auth</html:code> append <html:code>rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
         </html:code>
to the <html:code>pam_unix.so</html:code> entry, as shown below:

<html:pre>password sufficient pam_unix.so <html:i>...existing_options...</html:i> rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
         </html:pre>

The system's default number of rounds is 5000.</xccdf-1.2:description>
                <xccdf-1.2:warning category="performance">Setting a high number of hashing rounds makes it more difficult to brute force the password,
but requires more CPU resources to authenticate users.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001065</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271625r1091587_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Using a higher number of rounds makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_unix_rounds_password_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_unix_rounds='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>'



if [ -e "/etc/pam.d/password-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/password-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
            else
                echo "password    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\srounds\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ rounds=$var_password_pam_unix_rounds/" "$PAM_FILE_PATH"
        else
            sed -i -E --follow-symlinks "s/(\s*password\s+sufficient\s+pam_unix.so\s+.*)(rounds=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_unix_rounds \3/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/password-auth was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_unix_rounds_password_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001065
  - accounts_password_pam_unix_rounds_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_rounds # promote to variable
  set_fact:
    var_password_pam_unix_rounds: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
  tags:
    - always

- name: Set number of Password Hashing Rounds - password-auth - Check if /etc/pam.d/password-auth
    file is present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001065
  - accounts_password_pam_unix_rounds_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Set number of Password Hashing Rounds - password-auth - Check the proper remediation
    for the system
  block:

  - name: Set number of Password Hashing Rounds - password-auth - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Set number of Password Hashing Rounds - password-auth - Check if system
      relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set number of Password Hashing Rounds - password-auth - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set number of Password Hashing Rounds - password-auth - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set number of Password Hashing Rounds - password-auth - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set number of Password Hashing Rounds - password-auth - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set number of Password Hashing Rounds - password-auth - Define the new
        authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set number of Password Hashing Rounds - password-auth - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set number of Password Hashing Rounds - password-auth - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set number of Password Hashing Rounds - password-auth - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set number of Password Hashing Rounds - password-auth - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set number of Password Hashing Rounds - password-auth - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set number of Password Hashing Rounds - password-auth - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set number of Password Hashing Rounds - password-auth - Change the PAM
        file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set number of Password Hashing Rounds - password-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set number of Password Hashing Rounds - password-auth - Check if expected
      PAM module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Set number of Password Hashing Rounds - password-auth - Include or update
      the PAM module line in {{ pam_file_path }}
    block:

    - name: Set number of Password Hashing Rounds - password-auth - Check if required
        PAM module line is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_unix.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Set number of Password Hashing Rounds - password-auth - Ensure the correct
        control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Set number of Password Hashing Rounds - password-auth - Ensure the required
        PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_unix.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Set number of Password Hashing Rounds - password-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set number of Password Hashing Rounds - password-auth - Check if the required
      PAM module option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\srounds\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_unix_rounds_password_auth_option_present

  - name: Set number of Password Hashing Rounds - password-auth - Ensure the "rounds"
      PAM option for "pam_unix.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
      line: \1 rounds={{ var_password_pam_unix_rounds }}
      state: present
    register: result_pam_accounts_password_pam_unix_rounds_password_auth_add
    when:
    - result_pam_module_accounts_password_pam_unix_rounds_password_auth_option_present.found
      == 0

  - name: Set number of Password Hashing Rounds - password-auth - Ensure the required
      value for "rounds" PAM option from "pam_unix.so" in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s+.*)(rounds)=[0-9a-zA-Z]+\s*(.*)
      line: \1\2={{ var_password_pam_unix_rounds }} \3
    register: result_pam_accounts_password_pam_unix_rounds_password_auth_edit
    when:
    - result_pam_module_accounts_password_pam_unix_rounds_password_auth_option_present.found
      &gt; 0

  - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_accounts_password_pam_unix_rounds_password_auth_add is defined and result_pam_accounts_password_pam_unix_rounds_password_auth_add.changed)
       or (result_pam_accounts_password_pam_unix_rounds_password_auth_edit is defined and result_pam_accounts_password_pam_unix_rounds_password_auth_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001065
  - accounts_password_pam_unix_rounds_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth" severity="medium">
                <xccdf-1.2:title>Set number of Password Hashing Rounds - system-auth</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the number or rounds for the password hashing algorithm. This can be
accomplished by using the <html:code>rounds</html:code> option for the <html:code>pam_unix</html:code> PAM module.
<html:br/>
         <html:br/>
In file <html:code>/etc/pam.d/system-auth</html:code> append <html:code>rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
         </html:code>
to the <html:code>pam_unix.so</html:code> entry, as shown below:
<html:pre>password sufficient pam_unix.so <html:i>...existing_options...</html:i> rounds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
         </html:pre>
The system's default number of rounds is 5000.</xccdf-1.2:description>
                <xccdf-1.2:warning category="performance">Setting a high number of hashing rounds makes it more difficult to brute force the password,
but requires more CPU resources to authenticate users.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004062</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001070</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271626r1091590_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Using a higher number of rounds makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_password_pam_unix_rounds_system_auth"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_password_pam_unix_rounds='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>'


if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
            else
                echo "password    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\srounds\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ rounds=$var_password_pam_unix_rounds/" "$PAM_FILE_PATH"
        else
            sed -i -E --follow-symlinks "s/(\s*password\s+sufficient\s+pam_unix.so\s+.*)(rounds=)[[:alnum:]]+\s*(.*)/\1\2$var_password_pam_unix_rounds \3/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_password_pam_unix_rounds_system_auth" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001070
  - accounts_password_pam_unix_rounds_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_rounds # promote to variable
  set_fact:
    var_password_pam_unix_rounds: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" use="legacy"/>
  tags:
    - always

- name: Set number of Password Hashing Rounds - system-auth - Check if /etc/pam.d/system-auth
    file is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-001070
  - accounts_password_pam_unix_rounds_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Set number of Password Hashing Rounds - system-auth - Check the proper remediation
    for the system
  block:

  - name: Set number of Password Hashing Rounds - system-auth - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Set number of Password Hashing Rounds - system-auth - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set number of Password Hashing Rounds - system-auth - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      failed_when: false

    - name: Set number of Password Hashing Rounds - system-auth - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set number of Password Hashing Rounds - system-auth - Get authselect current
        profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set number of Password Hashing Rounds - system-auth - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set number of Password Hashing Rounds - system-auth - Define the new authselect
        custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set number of Password Hashing Rounds - system-auth - Get authselect current
        features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set number of Password Hashing Rounds - system-auth - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - authselect_current_profile is not match("custom/")

    - name: Set number of Password Hashing Rounds - system-auth - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set number of Password Hashing Rounds - system-auth - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set number of Password Hashing Rounds - system-auth - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set number of Password Hashing Rounds - system-auth - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set number of Password Hashing Rounds - system-auth - Change the PAM file
        to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
    when:
    - result_authselect_present.stat.exists

  - name: Set number of Password Hashing Rounds - system-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set number of Password Hashing Rounds - system-auth - Check if expected
      PAM module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Set number of Password Hashing Rounds - system-auth - Include or update
      the PAM module line in {{ pam_file_path }}
    block:

    - name: Set number of Password Hashing Rounds - system-auth - Check if required
        PAM module line is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_unix.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Set number of Password Hashing Rounds - system-auth - Ensure the correct
        control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Set number of Password Hashing Rounds - system-auth - Ensure the required
        PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_unix.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Set number of Password Hashing Rounds - system-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set number of Password Hashing Rounds - system-auth - Check if the required
      PAM module option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\srounds\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_unix_rounds_system_auth_option_present

  - name: Set number of Password Hashing Rounds - system-auth - Ensure the "rounds"
      PAM option for "pam_unix.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
      line: \1 rounds={{ var_password_pam_unix_rounds }}
      state: present
    register: result_pam_accounts_password_pam_unix_rounds_system_auth_add
    when:
    - result_pam_module_accounts_password_pam_unix_rounds_system_auth_option_present.found
      == 0

  - name: Set number of Password Hashing Rounds - system-auth - Ensure the required
      value for "rounds" PAM option from "pam_unix.so" in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s+.*)(rounds)=[0-9a-zA-Z]+\s*(.*)
      line: \1\2={{ var_password_pam_unix_rounds }} \3
    register: result_pam_accounts_password_pam_unix_rounds_system_auth_edit
    when:
    - result_pam_module_accounts_password_pam_unix_rounds_system_auth_option_present.found
      &gt; 0

  - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_accounts_password_pam_unix_rounds_system_auth_add is defined and result_pam_accounts_password_pam_unix_rounds_system_auth_add.changed)
       or (result_pam_accounts_password_pam_unix_rounds_system_auth_edit is defined and result_pam_accounts_password_pam_unix_rounds_system_auth_edit.changed)
  when:
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-001070
  - accounts_password_pam_unix_rounds_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_rounds:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" severity="low">
                <xccdf-1.2:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</xccdf-1.2:title>
                <xccdf-1.2:description>Add a group to the system for each GID referenced without a corresponding group.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.5.a</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271834r1092214_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Group Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-gid_passwd_group_same:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_empty_passwords" severity="high">
                <xccdf-1.2:title>Prevent Login to Accounts With Empty Password</xccdf-1.2:title>
                <xccdf-1.2:description>If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the
<html:code>nullok</html:code> in

<html:code>/etc/pam.d/system-auth</html:code> and
<html:code>/etc/pam.d/password-auth</html:code>

to prevent logins with empty passwords.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the system relies on <html:code>authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code>authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code>authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
Note that this rule is not applicable for systems running within a
container. Having user with empty password within a container is not
considered a risk, because it should not be possible to directly login into
a container anyway.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001110</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271634r1091614_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_empty_passwords" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature without-nullok

authselect apply-changes -b
else
    
if grep -qP "^\s*auth\s+sufficient\s+pam_unix.so\s.*\bnullok\b" "/etc/pam.d/system-auth"; then
    sed -i -E --follow-symlinks "s/(.*auth.*sufficient.*pam_unix.so.*)\snullok=?[[:alnum:]]*(.*)/\1\2/g" "/etc/pam.d/system-auth"
fi
    
if grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s.*\bnullok\b" "/etc/pam.d/system-auth"; then
    sed -i -E --follow-symlinks "s/(.*password.*sufficient.*pam_unix.so.*)\snullok=?[[:alnum:]]*(.*)/\1\2/g" "/etc/pam.d/system-auth"
fi
    
if grep -qP "^\s*auth\s+sufficient\s+pam_unix.so\s.*\bnullok\b" "/etc/pam.d/password-auth"; then
    sed -i -E --follow-symlinks "s/(.*auth.*sufficient.*pam_unix.so.*)\snullok=?[[:alnum:]]*(.*)/\1\2/g" "/etc/pam.d/password-auth"
fi
    
if grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s.*\bnullok\b" "/etc/pam.d/password-auth"; then
    sed -i -E --follow-symlinks "s/(.*password.*sufficient.*pam_unix.so.*)\snullok=?[[:alnum:]]*(.*)/\1\2/g" "/etc/pam.d/password-auth"
fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_empty_passwords" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2
  - DISA-STIG-OL09-00-001110
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - configure_strategy
  - high_severity
  - low_complexity
  - medium_disruption
  - no_empty_passwords
  - no_reboot_needed

- name: Prevent Login to Accounts With Empty Password - Check if system relies on
    authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.2
  - DISA-STIG-OL09-00-001110
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - configure_strategy
  - high_severity
  - low_complexity
  - medium_disruption
  - no_empty_passwords
  - no_reboot_needed

- name: Prevent Login to Accounts With Empty Password - Remediate using authselect
  block:

  - name: Prevent Login to Accounts With Empty Password - Check integrity of authselect
      current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Prevent Login to Accounts With Empty Password - Informative message based
      on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Prevent Login to Accounts With Empty Password - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Prevent Login to Accounts With Empty Password - Ensure "without-nullok"
      feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature without-nullok
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("without-nullok")

  - name: Prevent Login to Accounts With Empty Password - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.2
  - DISA-STIG-OL09-00-001110
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - configure_strategy
  - high_severity
  - low_complexity
  - medium_disruption
  - no_empty_passwords
  - no_reboot_needed

- name: Prevent Login to Accounts With Empty Password - Remediate directly editing
    PAM files
  ansible.builtin.replace:
    dest: '{{ item }}'
    regexp: nullok
  loop:
  - /etc/pam.d/system-auth
  - /etc/pam.d/password-auth
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.2
  - DISA-STIG-OL09-00-001110
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - configure_strategy
  - high_severity
  - low_complexity
  - medium_disruption
  - no_empty_passwords
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="no_empty_passwords">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/password-auth
        overwrite: true
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/system-auth
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_empty_passwords:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_empty_passwords_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" severity="high">
                <xccdf-1.2:title>Ensure There Are No Accounts With Blank or Null Passwords</xccdf-1.2:title>
                <xccdf-1.2:description>Check the "/etc/shadow" file for blank passwords with the
following command:
<html:pre>$ sudo awk -F: '!$2 {print $1}' /etc/shadow</html:pre>
If the command returns any results, this is a finding.
Configure all accounts on the system to have a password or lock
the account with the following commands:
Perform a password reset:
<html:pre>$ sudo passwd [username]</html:pre>
Lock an account:
<html:pre>$ sudo passwd -l [username]</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271638r1091626_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_empty_passwords_etc_shadow"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

readarray -t users_with_empty_pass &lt; &lt;(sudo awk -F: '!$2 {print $1}' /etc/shadow)

for user_with_empty_pass in "${users_with_empty_pass[@]}"
do
    passwd -l $user_with_empty_pass
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_empty_passwords_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-001130
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.2
  - high_severity
  - low_complexity
  - low_disruption
  - no_empty_passwords_etc_shadow
  - no_reboot_needed
  - restrict_strategy

- name: Collect users with no password
  command: |
    awk -F: '!$2 {print $1}' /etc/shadow
  register: users_nopasswd
  changed_when: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-001130
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.2
  - high_severity
  - low_complexity
  - low_disruption
  - no_empty_passwords_etc_shadow
  - no_reboot_needed
  - restrict_strategy

- name: Lock users with no password
  command: |
    passwd -l {{ item }}
  with_items: '{{ users_nopasswd.stdout_lines }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - users_nopasswd is not skipped and users_nopasswd.stdout_lines | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-001130
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.2
  - high_severity
  - low_complexity
  - low_disruption
  - no_empty_passwords_etc_shadow
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_empty_passwords_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_empty_passwords_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_netrc_files" severity="medium">
                <xccdf-1.2:title>Verify No netrc Files Exist</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>.netrc</html:code> files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used.  Any <html:code>.netrc</html:code> files should be removed.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(7)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Unencrypted passwords for remote FTP servers may be stored in <html:code>.netrc</html:code>
files.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_netrc_files:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_netrc_files_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_root_logins">
              <xccdf-1.2:title>Restrict Root Logins</xccdf-1.2:title>
              <xccdf-1.2:description>Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system
via a unique unprivileged account, and then use <html:code>su</html:code> or <html:code>sudo</html:code> to execute
privileged commands. Discouraging administrators from accessing the
root account directly ensures an audit trail in organizations with
multiple administrators. Locking down the channels through which
root can connect directly also reduces opportunities for
password-guessing against the root account. The <html:code>login</html:code> program
uses the file <html:code>/etc/securetty</html:code> to determine which interfaces
should allow root logins.

The virtual devices <html:code>/dev/console</html:code>
and <html:code>/dev/tty*</html:code> represent the system consoles (accessible via
the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
installation). The default securetty file also contains <html:code>/dev/vc/*</html:code>.
These are likely to be deprecated in most environments, but may be retained
for compatibility. Root should also be prohibited from connecting
via network protocols. Other sections of this document
include guidance describing how to prevent root from logging in via SSH.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" type="string">
                <xccdf-1.2:title>Group Name Used by pam_wheel Group Parameter</xccdf-1.2:title>
                <xccdf-1.2:description>pam_wheel module has a parameter called group, which controls which groups
can access the su command.
This variable holds the valid value for the parameter.</xccdf-1.2:description>
                <xccdf-1.2:value>sugroup</xccdf-1.2:value>
                <xccdf-1.2:value selector="cis">sugroup</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" severity="high">
                <xccdf-1.2:title>Verify Only Root Has UID 0</xccdf-1.2:title>
                <xccdf-1.2:description>If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed or have
their UID changed.
<html:br/>
If the account is associated with system commands or applications the UID
should be changed to one greater than "0" but less than "1000."
Otherwise assign a UID greater than "1000" that has not already been
assigned.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003000</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271831r1092205_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_no_uid_except_zero">awk -F: '$3 == 0 &amp;&amp; $1 != "root" { print $1 }' /etc/passwd | xargs --no-run-if-empty --max-lines=1 passwd -l
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_no_uid_except_zero" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all /etc/passwd file entries
  getent:
    database: passwd
    split: ':'
  tags:
  - DISA-STIG-OL09-00-003000
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6(5)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-4(b)
  - PCI-DSS-Req-8.5
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.1
  - accounts_no_uid_except_zero
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Lock the password of the user accounts other than root with uid 0
  command: passwd -l {{ item.key }}
  loop: '{{ getent_passwd | dict2items | rejectattr(''key'', ''search'', ''root'')
    | list }}'
  when: item.value.1  == '0'
  tags:
  - DISA-STIG-OL09-00-003000
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6(5)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-4(b)
  - PCI-DSS-Req-8.5
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.1
  - accounts_no_uid_except_zero
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_no_uid_except_zero:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" severity="high">
                <xccdf-1.2:title>Verify Root Has A Primary GID 0</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>root</html:code> user should have a primary group of 0.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>To help ensure that root-owned files are not inadvertently exposed to other users.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_root_gid_zero:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_root_gid_zero_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty" severity="medium">
                <xccdf-1.2:title>Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty</xccdf-1.2:title>
                <xccdf-1.2:description>Ensure that the group <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" use="legacy"/></html:code> referenced by
<html:code>var_pam_wheel_group_for_su</html:code> variable and used as value for the <html:code>pam_wheel.so</html:code>
         <html:code>group</html:code> option exists and has no members. This empty group used by
<html:code>pam_wheel.so</html:code> in <html:code>/etc/pam.d/su</html:code> ensures that no user can run commands with
altered privileges through the <html:code>su</html:code> command.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that this rule just ensures the group exists and has no members. This rule does not
configure <html:code>pam_wheel.so</html:code> module. The <html:code>pam_wheel.so</html:code> module configuration is
accomplished by <html:code>use_pam_wheel_group_for_su</html:code> rule.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>su</html:code> program allows to run commands with a substitute user and group ID.
It is commonly used to run commands as the root user.
Limiting access to such command is considered a good security practice.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_pam_wheel_group_for_su:var:1" value-id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_pam_wheel_group_empty:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_pam_wheel_group_empty_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_root_password_configured" severity="medium">
                <xccdf-1.2:title>Ensure Authentication Required for Single User Mode</xccdf-1.2:title>
                <xccdf-1.2:description>Single user mode is used for recovery when the system detects an
issue during boot or by manual selection from the bootloader.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Requiring authentication in single user mode prevents an unauthorized
user from rebooting the system into single user to gain root privileges
without credentials.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_root_password_configured:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_root_password_configured_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_direct_root_logins" severity="medium">
                <xccdf-1.2:title>Direct root Logins Not Allowed</xccdf-1.2:title>
                <xccdf-1.2:description>To further limit access to the <html:code>root</html:code> account, administrators
can disable root logins at the console by editing the <html:code>/etc/securetty</html:code> file.
This file lists all devices the root user is allowed to login to. If the file does
not exist at all, the root user can login through any communication device on the
system, whether via the console or via a raw network interface. This is dangerous
as user can login to the system as root via Telnet, which sends the password in
plain text over the network. By default, Oracle Linux 9's
<html:code>/etc/securetty</html:code> file only allows the root user to login at the console
physically attached to the system. To prevent root from logging in, remove the
contents of this file. To prevent direct root logins, remove the contents of this
file by typing the following command:
<html:pre>
$ sudo echo &gt; /etc/securetty
</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">This rule only checks the <html:code>/etc/securetty</html:code> file existence and its content.
If you need to restrict user access using the <html:code>/etc/securetty</html:code> file, make sure
the <html:code>pam_securetty.so</html:code> PAM module is properly enabled in relevant PAM files.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling direct root logins ensures proper accountability and multifactor
authentication to privileged accounts. Users will first login, then escalate
to privileged (root) access via su / sudo. This is required for FISMA Low
and FISMA Moderate systems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_direct_root_logins"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

echo &gt; /etc/securetty

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_direct_root_logins" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - low_complexity
  - low_disruption
  - medium_severity
  - no_direct_root_logins
  - no_reboot_needed
  - restrict_strategy

- name: Direct root Logins Not Allowed
  copy:
    dest: /etc/securetty
    content: ''
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - low_complexity
  - low_disruption
  - medium_severity
  - no_direct_root_logins
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_direct_root_logins:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" severity="medium">
                <xccdf-1.2:title>Ensure that System Accounts Are Locked</xccdf-1.2:title>
                <xccdf-1.2:description>Some accounts are not associated with a human user of the system, and exist to perform some
administrative functions. An attacker should not be able to log into these accounts.
<html:br/>
         <html:br/>
System accounts are those user accounts with a user ID less than <html:code>1000</html:code>.
If any system account other than <html:code>root</html:code>, <html:code>halt</html:code>, <html:code>sync</html:code>, <html:code>shutdown</html:code>
and <html:code>nfsnobody</html:code> has an unlocked password, disable it with the command:
<html:pre>$ sudo usermod -L <html:i>account</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Disabling authentication for default system accounts makes it more difficult for attackers
to make use of them to compromise a system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_password_auth_for_systemaccounts" complexity="low" disruption="medium" reboot="false" strategy="restrict">
readarray -t systemaccounts &lt; &lt;(awk -F: \
  '($3 &lt; 1000 &amp;&amp; $3 != root &amp;&amp; $3 != halt &amp;&amp; $3 != sync &amp;&amp; $3 != shutdown \
  &amp;&amp; $3 != nfsnobody) { print $1 }' /etc/passwd)

for systemaccount in "${systemaccounts[@]}"; do
    usermod -L "$systemaccount"
done
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_password_auth_for_systemaccounts" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Ensure that System Accounts Are Locked - Get All Local Users From /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy

- name: Ensure that System Accounts Are Locked - Create local_users Variable From
    getent_passwd Facts
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd | dict2items }}'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy

- name: Ensure that System Accounts Are Locked - Lock System Accounts
  ansible.builtin.user:
    name: '{{ item.key }}'
    password_lock: true
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &lt; 1000
  - item.key not in ['root', 'halt', 'sync', 'shutdown', 'nfsnobody']
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_password_auth_for_systemaccounts:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" severity="medium">
                <xccdf-1.2:title>Ensure that System Accounts Do Not Run a Shell Upon Login</xccdf-1.2:title>
                <xccdf-1.2:description>Some accounts are not associated with a human user of the system, and exist to perform some
administrative functions. Should an attacker be able to log into these accounts, they should
not be granted access to a shell.
<html:br/>
         <html:br/>
The login shell for each local account is stored in the last field of each line in
<html:code>/etc/passwd</html:code>. System accounts are those user accounts with a user ID less than
<html:code>1000</html:code>. The user ID is stored in the third field. If any system account
other than <html:code>root</html:code> has a login shell, disable it with the command:
<html:pre>$ sudo usermod -s /sbin/nologin <html:i>account</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">Do not perform the steps in this section on the root account. Doing so might cause the
system to become inaccessible.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1491</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003051</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271845r1092247_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Ensuring shells are not given to system accounts upon login makes it more difficult for
attackers to make use of system accounts.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_shelllogin_for_systemaccounts" complexity="low" disruption="medium" reboot="false" strategy="restrict">
readarray -t systemaccounts &lt; &lt;(awk -F: '($3 &lt; 1000 &amp;&amp; $3 != root \
  &amp;&amp; $7 != "\/sbin\/shutdown" &amp;&amp; $7 != "\/sbin\/halt" &amp;&amp; $7 != "\/bin\/sync") \
  { print $1 }' /etc/passwd)

for systemaccount in "${systemaccounts[@]}"; do
    usermod -s /sbin/nologin "$systemaccount"
done
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_shelllogin_for_systemaccounts" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Ensure that System Accounts Do Not Run a Shell Upon Login - Get All Local
    Users From /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - DISA-STIG-OL09-00-003051
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login - Create local_users
    Variable From getent_passwd Facts
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd | dict2items }}'
  tags:
  - DISA-STIG-OL09-00-003051
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login -  Disable Login
    Shell for System Accounts
  ansible.builtin.user:
    name: '{{ item.key }}'
    shell: /sbin/nologin
  loop: '{{ local_users }}'
  when:
  - item.key not in ['root']
  - item.value[1]|int &lt; 1000
  - item.value[5] not in ['/sbin/shutdown', '/sbin/halt', '/bin/sync']
  tags:
  - DISA-STIG-OL09-00-003051
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_shelllogin_for_systemaccounts:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" severity="medium">
                <xccdf-1.2:title>Restrict Serial Port Root Logins</xccdf-1.2:title>
                <xccdf-1.2:description>To restrict root logins on serial ports,
ensure lines of this form do not appear in <html:code>/etc/securetty</html:code>:
<html:pre>ttyS0
ttyS1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing direct root login to serial port interfaces
helps ensure accountability for actions taken on the systems
using the root account.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="restrict_serial_port_logins">sed -i '/ttyS/d' /etc/securetty
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="restrict_serial_port_logins" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Restrict Serial Port Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ttyS[0-9]
    state: absent
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_serial_port_logins
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-restrict_serial_port_logins:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" severity="medium">
                <xccdf-1.2:title>Restrict Virtual Console Root Logins</xccdf-1.2:title>
                <xccdf-1.2:description>To restrict root logins through the (deprecated) virtual console devices,
ensure lines of this form do not appear in <html:code>/etc/securetty</html:code>:
<html:pre>vc/1
vc/2
vc/3
vc/4</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Preventing direct root login to virtual console devices
helps ensure accountability for actions taken on the system
using the root account.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="securetty_root_login_console_only">sed -i '/^vc\/[0-9]/d' /etc/securetty
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="securetty_root_login_console_only" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Restrict Virtual Console Root Logins
  lineinfile:
    dest: /etc/securetty
    regexp: ^vc/[0-9]
    state: absent
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - securetty_root_login_console_only
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-securetty_root_login_console_only:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su" severity="medium">
                <xccdf-1.2:title>Enforce usage of pam_wheel for su authentication</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure that only users who are members of the <html:code>wheel</html:code> group can
run commands with altered privileges through the <html:code>su</html:code> command, make
sure that the following line exists in the file <html:code>/etc/pam.d/su</html:code>:
<html:pre>auth required pam_wheel.so use_uid</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Members of "wheel" or GID 0 groups are checked by default if the group option is not set
for pam_wheel.so module. Therefore, members of these groups should be manually checked or
a different group should be informed according to the site policy.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004895</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002361</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271723r1091881_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>su</html:code> program allows to run commands with a substitute user and
group ID. It is commonly used to run commands as the root user. Limiting
access to such command is considered a good security practice.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="use_pam_wheel_for_su"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

# uncomment the option if commented
sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="use_pam_wheel_for_su" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002361
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - use_pam_wheel_for_su

- name: Restrict usage of su command only to members of wheel group
  replace:
    path: /etc/pam.d/su
    regexp: ^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$
    replace: auth             required        pam_wheel.so use_uid
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002361
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - use_pam_wheel_for_su
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-use_pam_wheel_for_su:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-use_pam_wheel_for_su_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su" severity="medium">
                <xccdf-1.2:title>Enforce Usage of pam_wheel with Group Parameter for su Authentication</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure that only users who are members of the group set in the <html:code>group</html:code> option of
<html:code>pam_wheel.so</html:code> module can run commands with altered privileges through the <html:code>su</html:code>
command, make sure that the following line exists in the file <html:code>/etc/pam.d/su</html:code>:
<html:pre>auth required pam_wheel.so use_uid group=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">Note that <html:code>ensure_pam_wheel_group_empty</html:code> rule complements this requirement by
ensuring the referenced group exists and has no members.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>su</html:code> program allows to run commands with a substitute user and group ID.
It is commonly used to run commands as the root user.
Limiting access to such command is considered a good security practice.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_pam_wheel_group_for_su:var:1" value-id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-use_pam_wheel_group_for_su:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-use_pam_wheel_group_for_su_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-session">
            <xccdf-1.2:title>Secure Session Configuration Files for Login Accounts</xccdf-1.2:title>
            <xccdf-1.2:description>When a user logs into a Unix account, the system
configures the user's session by reading a number of files. Many of
these files are located in the user's home directory, and may have
weak permissions as a result of user error or misconfiguration. If
an attacker can modify or even read certain types of account
configuration information, they can often gain full access to the
affected user's account. Therefore, it is important to test and
correct configuration file permissions for interactive accounts,
particularly those of privileged users such as root or system
administrators.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" type="number">
              <xccdf-1.2:title>Maximum login attempts delay</xccdf-1.2:title>
              <xccdf-1.2:description>Maximum time in seconds between fail login attempts before re-prompting.</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>4</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" type="number">
              <xccdf-1.2:title>Maximum concurrent login sessions</xccdf-1.2:title>
              <xccdf-1.2:description>Maximum number of concurrent sessions by a user</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>1</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_tmout" type="number">
              <xccdf-1.2:title>Account Inactivity Timeout (seconds)</xccdf-1.2:title>
              <xccdf-1.2:description>In an interactive shell, the value is interpreted as the
number of seconds to wait for input after issuing the primary prompt.
Bash terminates after waiting for that number of seconds if input does
not arrive.</xccdf-1.2:description>
              <xccdf-1.2:value selector="30_min">1800</xccdf-1.2:value>
              <xccdf-1.2:value selector="10_min">600</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_min">900</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_min">300</xccdf-1.2:value>
              <xccdf-1.2:value>600</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" type="string">
              <xccdf-1.2:title>Interactive users initialization files</xccdf-1.2:title>
              <xccdf-1.2:description>'A regular expression describing a list of file names
for files that are sourced at login time for interactive users'</xccdf-1.2:description>
              <xccdf-1.2:value>^(\.bashrc|\.zshrc|\.cshrc|\.profile|\.bash_login|\.bash_profile)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="all_dotfiles">^\.[\w\- ]+$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" severity="medium">
              <xccdf-1.2:title>Ensure Home Directories are Created for New Users</xccdf-1.2:title>
              <xccdf-1.2:description>All local interactive user accounts, upon creation, should be assigned a home directory.
<html:br/>
        <html:br/>
Configure the operating system to assign home directories to all new local interactive users by setting the <html:code>CREATE_HOME</html:code>
parameter in <html:code>/etc/login.defs</html:code> to <html:code>yes</html:code> as follows:
<html:br/>
        <html:br/>
        <html:pre>CREATE_HOME yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003052</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271846r1092250_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If local interactive users are not assigned a valid home directory, there is no place
for the storage and control of files they should own.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_shadow-utils"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_have_homedir_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

if [ -e "/etc/login.defs" ] ; then
    
    LC_ALL=C sed -i "/^\s*CREATE_HOME\s\+/Id" "/etc/login.defs"
else
    touch "/etc/login.defs"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/login.defs"

cp "/etc/login.defs" "/etc/login.defs.bak"
# Insert before the line matching the regex '^\s*CREATE_HOME'.
line_number="$(LC_ALL=C grep -n "^\s*CREATE_HOME" "/etc/login.defs.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^\s*CREATE_HOME', insert at
    # the end of the file.
    printf '%s\n' "CREATE_HOME yes" &gt;&gt; "/etc/login.defs"
else
    head -n "$(( line_number - 1 ))" "/etc/login.defs.bak" &gt; "/etc/login.defs"
    printf '%s\n' "CREATE_HOME yes" &gt;&gt; "/etc/login.defs"
    tail -n "+$(( line_number ))" "/etc/login.defs.bak" &gt;&gt; "/etc/login.defs"
fi
# Clean up after ourselves.
rm "/etc/login.defs.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_have_homedir_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-003052
  - accounts_have_homedir_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure new users receive home directories
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/login.defs
      create: true
      regexp: (?i)^\s*CREATE_HOME\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/login.defs
    lineinfile:
      path: /etc/login.defs
      create: true
      regexp: (?i)^\s*CREATE_HOME\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/login.defs
    lineinfile:
      path: /etc/login.defs
      create: true
      regexp: (?i)^\s*CREATE_HOME\s+
      line: CREATE_HOME yes
      state: present
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003052
  - accounts_have_homedir_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_have_homedir_login_defs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_have_homedir_login_defs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" severity="medium">
              <xccdf-1.2:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</xccdf-1.2:title>
              <xccdf-1.2:description>To ensure the logon failure delay controlled by <html:code>/etc/login.defs</html:code> is set properly,
add or correct the <html:code>FAIL_DELAY</html:code> setting in <html:code>/etc/login.defs</html:code> to read as follows:
<html:pre>FAIL_DELAY <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00226</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003070</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271850r1092262_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Increasing the time between a failed authentication attempt and re-prompting to
enter credentials helps to slow a single-threaded brute force attack.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_shadow-utils"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_logon_fail_delay"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_fail_delay='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^FAIL_DELAY")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_fail_delay"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^FAIL_DELAY\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^FAIL_DELAY\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_logon_fail_delay" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-003070
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - accounts_logon_fail_delay
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_accounts_fail_delay # promote to variable
  set_fact:
    var_accounts_fail_delay: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" use="legacy"/>
  tags:
    - always

- name: Set accounts logon fail delay
  lineinfile:
    dest: /etc/login.defs
    regexp: ^FAIL_DELAY
    line: FAIL_DELAY {{ var_accounts_fail_delay }}
    create: true
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-003070
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - accounts_logon_fail_delay
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_fail_delay:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_logon_fail_delay:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" severity="low">
              <xccdf-1.2:title>Limit the Number of Concurrent Login Sessions Allowed Per User</xccdf-1.2:title>
              <xccdf-1.2:description>Limiting the number of allowed users and sessions per user can limit risks related to Denial of
Service attacks. This addresses concurrent sessions for a single account and does not address
concurrent sessions by a single user via multiple accounts. To set the number of concurrent
sessions per user add the following line in <html:code>/etc/security/limits.conf</html:code> or
a file under <html:code>/etc/security/limits.d/</html:code>:
<html:pre>* hard maxlogins <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000054</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000027-GPOS-00008</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002415</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271753r1091971_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Limiting simultaneous user logins can insulate the system from denial of service
problems caused by excessive logins. Automated login processes operating improperly or
maliciously may result in an exceptional number of simultaneous login sessions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_pam"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_max_concurrent_login_sessions"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

var_accounts_max_concurrent_login_sessions='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/>'


if grep -q '^[^#]*\&lt;maxlogins\&gt;' /etc/security/limits.d/*.conf; then
	sed -i "/^[^#]*\&lt;maxlogins\&gt;/ s/maxlogins.*/maxlogins $var_accounts_max_concurrent_login_sessions/" /etc/security/limits.d/*.conf
elif grep -q '^[^#]*\&lt;maxlogins\&gt;' /etc/security/limits.conf; then
	sed -i "/^[^#]*\&lt;maxlogins\&gt;/ s/maxlogins.*/maxlogins $var_accounts_max_concurrent_login_sessions/" /etc/security/limits.conf
else
	echo "*	hard	maxlogins	$var_accounts_max_concurrent_login_sessions" &gt;&gt; /etc/security/limits.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_max_concurrent_login_sessions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002415
  - NIST-800-53-AC-10
  - NIST-800-53-CM-6(a)
  - accounts_max_concurrent_login_sessions
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_max_concurrent_login_sessions # promote to variable
  set_fact:
    var_accounts_max_concurrent_login_sessions: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" use="legacy"/>
  tags:
    - always

- name: Find /etc/security/limits.d files containing maxlogins configuration
  find:
    paths: /etc/security/limits.d
    contains: ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins
    patterns: '*.conf'
  register: maxlogins
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002415
  - NIST-800-53-AC-10
  - NIST-800-53-CM-6(a)
  - accounts_max_concurrent_login_sessions
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Limit the Number of Concurrent Login Sessions Allowed Per User in files from
    limits.d
  replace:
    dest: '{{ item.path }}'
    regexp: ^#?\*.*maxlogins.*
    replace: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
      }}'
  with_items:
  - '{{ maxlogins.files }}'
  when: '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002415
  - NIST-800-53-AC-10
  - NIST-800-53-CM-6(a)
  - accounts_max_concurrent_login_sessions
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Limit the Number of Concurrent Login Sessions Allowed Per User
  lineinfile:
    state: present
    dest: /etc/security/limits.conf
    insertbefore: ^# End of file
    regexp: ^#?\*.*maxlogins
    line: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
      }}'
    create: true
  when:
  - '"pam" in ansible_facts.packages'
  - maxlogins.matched == 0
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002415
  - NIST-800-53-AC-10
  - NIST-800-53-CM-6(a)
  - accounts_max_concurrent_login_sessions
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_max_concurrent_login_sessions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_tmp" severity="low">
              <xccdf-1.2:title>Configure Polyinstantiation of /tmp Directories</xccdf-1.2:title>
              <xccdf-1.2:description>To configure polyinstantiated /tmp directories, first create the parent directories
which will hold the polyinstantiation child directories. Use the following command:
<html:pre>$ sudo mkdir --mode 000 /tmp/tmp-inst</html:pre>
Then, add the following entry to <html:code>/etc/security/namespace.conf</html:code>:
<html:pre>/tmp     /tmp/tmp-inst/            level      root,adm</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R55</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Polyinstantiation of temporary directories is a proactive security measure
which reduces chances of attacks that are made possible by /tmp
directories being world-writable.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_polyinstantiated_tmp">
# shellcheck disable=SC2174
mkdir -p --mode 000 /tmp/tmp-inst
chmod 000 /tmp/tmp-inst
chcon --reference=/tmp /tmp/tmp-inst

if ! grep -Eq '^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$' /etc/security/namespace.conf ; then
    if grep -Eq '^\s*/tmp\s+' /etc/security/namespace.conf ; then
        sed -i '/^\s*\/tmp/d' /etc/security/namespace.conf
    fi
    echo "/tmp     /tmp/tmp-inst/        level      root,adm" &gt;&gt; /etc/security/namespace.conf
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_polyinstantiated_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_polyinstantiated_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_polyinstantiated_var_tmp" severity="low">
              <xccdf-1.2:title>Configure Polyinstantiation of /var/tmp Directories</xccdf-1.2:title>
              <xccdf-1.2:description>To configure polyinstantiated /tmp directories, first create the parent directories
which will hold the polyinstantiation child directories. Use the following command:
<html:pre>$ sudo mkdir --mode 000 /var/tmp/tmp-inst</html:pre>
Then, add the following entry to <html:code>/etc/security/namespace.conf</html:code>:
<html:pre>/var/tmp /var/tmp/tmp-inst/    level      root,adm</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R55</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Polyinstantiation of temporary directories is a proactive security measure
which reduces chances of attacks that are made possible by /var/tmp
directories being world-writable.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_polyinstantiated_var_tmp">
# shellcheck disable=SC2174
mkdir -p --mode 000 /var/tmp/tmp-inst
chmod 000 /var/tmp/tmp-inst
chcon --reference=/var/tmp /var/tmp/tmp-inst

if ! grep -Eq '^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$' /etc/security/namespace.conf ; then
    if grep -Eq '^\s*/var/tmp\s+' /etc/security/namespace.conf ; then
        sed -i '/^\s*\/var\/tmp/d' /etc/security/namespace.conf
    fi
    echo "/var/tmp /var/tmp/tmp-inst/    level      root,adm" &gt;&gt; /etc/security/namespace.conf
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_polyinstantiated_var_tmp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_polyinstantiated_var_tmp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_tmout" severity="medium">
              <xccdf-1.2:title>Set Interactive Session Timeout</xccdf-1.2:title>
              <xccdf-1.2:description>Setting the <html:code>TMOUT</html:code> option in <html:code>/etc/profile</html:code> ensures that
all user sessions will terminate based on inactivity.
The value of TMOUT should be exported and read only.
The <html:code>TMOUT</html:code>

setting in a file loaded by <html:code>/etc/profile</html:code>, e.g.
<html:code>/etc/profile.d/tmout.sh</html:code> should read as follows:
<html:pre>typeset -xr TMOUT=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
        </html:pre>
or
<html:pre>declare -xr TMOUT=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
        </html:pre>
Using the <html:code>typeset</html:code> keyword is preferred for wider compatibility with ksh and other shells.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R32</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002411</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271750r1091962_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Terminating an idle session within a short time period reduces
the window of opportunity for unauthorized personnel to take control of a
management session enabled on the console or console port that has been
left unattended.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_tmout"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_accounts_tmout='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>'


# if 0, no occurence of tmout found, if 1, occurence found
tmout_found=0


for f in /etc/profile /etc/profile.d/*.sh; do

    if grep --silent '^[^#].*TMOUT' $f; then
        sed -i -E "s/^(.*)TMOUT\s*=\s*(\w|\$)*(.*)$/typeset -xr TMOUT=$var_accounts_tmout\3/g" $f
        tmout_found=1
    fi
done

if [ $tmout_found -eq 0 ]; then
        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" &gt;&gt; /etc/profile.d/tmout.sh
        echo "typeset -xr TMOUT=$var_accounts_tmout" &gt;&gt; /etc/profile.d/tmout.sh
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_tmout" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002411
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - accounts_tmout
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_tmout # promote to variable
  set_fact:
    var_accounts_tmout: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
  tags:
    - always

- name: Correct any occurrence of TMOUT in /etc/profile
  replace:
    path: /etc/profile
    regexp: ^[^#].*TMOUT=.*
    replace: typeset -xr TMOUT={{ var_accounts_tmout }}
  register: profile_replaced
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002411
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - accounts_tmout
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interactive Session Timeout
  lineinfile:
    path: /etc/profile.d/tmout.sh
    create: true
    regexp: TMOUT=
    line: typeset -xr TMOUT={{ var_accounts_tmout }}
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002411
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - accounts_tmout
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_tmout:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_tmout"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_tmout:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_tmout_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership" severity="medium">
              <xccdf-1.2:title>User Initialization Files Must Be Group-Owned By The Primary Group</xccdf-1.2:title>
              <xccdf-1.2:description>Change the group owner of interactive users files to the group found
in <html:pre>/etc/passwd</html:pre> for the user. To change the group owner of a local
interactive user home directory, use the following command:
<html:pre>$ sudo chgrp <html:i>USER_GROUP</html:i> /home/<html:i>USER</html:i>/.<html:i>INIT_FILE</html:i>
        </html:pre>

This rule ensures every initialization file related to an interactive user
is group-owned by an interactive user.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective initialization files.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Local initialization files for interactive users are used to configure the
user's shell environment upon logon. Malicious modification of these files could
compromise accounts upon logon.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_user_dot_group_ownership" complexity="low" disruption="low" reboot="false" strategy="restrict">
awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chgrp -f " $4" "$6"/.[^\.]?*") }' /etc/passwd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_user_dot_group_ownership" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure interactive local users are the group-owners of their respective initialization
    files
  ansible.builtin.command:
    cmd: awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chgrp -f " $4" "$6"/.[^\.]?*")
      }' /etc/passwd
  tags:
  - accounts_user_dot_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_user_dot_group_ownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_user_dot_group_ownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs" severity="medium">
              <xccdf-1.2:title>User Initialization Files Must Not Run World-Writable Programs</xccdf-1.2:title>
              <xccdf-1.2:description>Set the mode on files being executed by the user initialization files with the
following command:
<html:pre>$ sudo chmod o-w <html:i>FILE</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002427</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271765r1092007_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If user start-up files execute world-writable programs, especially in
unprotected directories, they could be maliciously modified to destroy user
files or otherwise compromise the system at the user level. If the system is
compromised at the user level, it is easier to elevate privileges to eventually
compromise the system at the root and network level.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_user_dot_no_world_writable_programs" complexity="low" disruption="low" reboot="false" strategy="restrict">
readarray -t world_writable_files &lt; &lt;(find / -xdev -type f -perm -0002 2&gt; /dev/null)
readarray -t interactive_home_dirs &lt; &lt;(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $6 }' /etc/passwd)

for world_writable in "${world_writable_files[@]}"; do
    for homedir in "${interactive_home_dirs[@]}"; do
        if grep -q -d skip "$world_writable" "$homedir"/.*; then
            chmod o-w $world_writable
            break
        fi
    done
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_user_dot_no_world_writable_programs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: User Initialization Files Must Not Run World-Writable Programs - Initialize
    variables
  set_fact:
    home_user_dirs: []
    world_writable_files: []
  tags:
  - DISA-STIG-OL09-00-002427
  - accounts_user_dot_no_world_writable_programs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Not Run World-Writable Programs - Get user's
    home dir list
  ansible.builtin.getent:
    database: passwd
  register: passwd_database
  tags:
  - DISA-STIG-OL09-00-002427
  - accounts_user_dot_no_world_writable_programs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Not Run World-Writable Programs - Fill home_user_dirs
  set_fact:
    home_user_dirs: '{{ home_user_dirs + [item.data[4]] }}'
  when: item.data[4] is defined and item.data[2]|int &gt;= 1000 and item.data[2]|int
    != 65534
  with_items: '{{ passwd_database.ansible_facts.getent_passwd | dict2items(key_name=''user'',
    value_name=''data'')}}'
  tags:
  - DISA-STIG-OL09-00-002427
  - accounts_user_dot_no_world_writable_programs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Not Run World-Writable Programs - Get world
    writable files
  ansible.builtin.shell: |
    find / -xdev -type f -perm -0002 2&gt; /dev/null
  register: world_writable_files
  tags:
  - DISA-STIG-OL09-00-002427
  - accounts_user_dot_no_world_writable_programs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Not Run World-Writable Programs - Find referenced_files
    in init files
  ansible.builtin.find:
    paths: '{{ home_user_dirs }}'
    contains: '{{ item }}'
    hidden: true
    read_whole_file: true
    recurse: true
  with_items: '{{ world_writable_files.stdout_lines }}'
  register: referenced_files
  tags:
  - DISA-STIG-OL09-00-002427
  - accounts_user_dot_no_world_writable_programs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Not Run World-Writable Programs - Remove world
    writable permissions
  ansible.builtin.file:
    path: '{{ item.item }}'
    mode: o-w
  when: item.matched &gt; 0
  with_items: '{{ referenced_files.results }}'
  tags:
  - DISA-STIG-OL09-00-002427
  - accounts_user_dot_no_world_writable_programs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_user_initialization_files_regex:var:1" value-id="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_user_dot_no_world_writable_programs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_user_dot_no_world_writable_programs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership" severity="medium">
              <xccdf-1.2:title>User Initialization Files Must Be Owned By the Primary User</xccdf-1.2:title>
              <xccdf-1.2:description>Set the owner of the user initialization files for interactive users to
the primary owner with the following command:
<html:pre>$ sudo chown <html:i>USER</html:i> /home/<html:i>USER</html:i>/.*</html:pre>

This rule ensures every initialization file related to an interactive user
is owned by an interactive user.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the ownership of
their respective initialization files.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Local initialization files are used to configure the user's shell environment
upon logon. Malicious modification of these files could compromise accounts upon
logon.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_user_dot_user_ownership" complexity="low" disruption="low" reboot="false" strategy="restrict">
awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chown -f " $3" "$6"/.[^\.]?*") }' /etc/passwd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_user_dot_user_ownership" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure interactive local users are the owners of their respective initialization
    files
  ansible.builtin.command:
    cmd: awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chown -f " $3" "$6"/.[^\.]?*")
      }' /etc/passwd
  tags:
  - accounts_user_dot_user_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_user_dot_user_ownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_user_dot_user_ownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_user_home_paths_only" severity="medium">
              <xccdf-1.2:title>Ensure that Users Path Contains Only Local Directories</xccdf-1.2:title>
              <xccdf-1.2:description>Ensure that all interactive user initialization files executable search
path statements do not contain statements that will reference a working
directory other than the users home directory.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003053</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271847r1092253_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The executable search path (typically the PATH environment variable) contains a
list of directories for the shell to search to find executables. If this path
includes the current working directory (other than the users home directory),
executables in these directories may be executed instead of system commands.
This variable is formatted as a colon-separated list of directories. If there is
an empty entry, such as a leading or trailing colon or two consecutive colons,
this is interpreted as the current working directory. If deviations from the
default system search path for the local interactive user are required, they
must be documented with the Information System Security Officer (ISSO).</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_user_home_paths_only_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined" severity="medium">
              <xccdf-1.2:title>All Interactive Users Must Have A Home Directory Defined</xccdf-1.2:title>
              <xccdf-1.2:description>Assign home directories to all interactive users that currently do not
have a home directory assigned.

This rule checks if the home directory is properly defined in a folder which has
at least one parent folder, like "user" in "/home/user" or "/remote/users/user".
Therefore, this rule will report a finding for home directories like <html:code>/users</html:code>,
<html:code>/tmp</html:code> or <html:code>/</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003002</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271833r1092607_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If local interactive users are not assigned a valid home directory, there is no
place for the storage and control of files they should own.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_user_interactive_home_directory_defined" complexity="low" disruption="low" reboot="false" strategy="restrict">
for user in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $1 }' /etc/passwd); do
    # This follows the same logic of evaluation of home directories as used in OVAL.
    if ! grep -q $user /etc/passwd | cut -d: -f6 | grep '^\/\w*\/\w\{1,\}'; then
        sed -i "s/\($user:x:[0-9]*:[0-9]*:.*:\).*\(:.*\)$/\1\/home\/$user\2/g" /etc/passwd;
    fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_user_interactive_home_directory_defined" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - DISA-STIG-OL09-00-003002
  - accounts_user_interactive_home_directory_defined
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - DISA-STIG-OL09-00-003002
  - accounts_user_interactive_home_directory_defined
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive users have an exclusive home directory defined
  ansible.builtin.user:
    name: '{{ item.key }}'
    home: /home/{{ item.key }}
    create_home: false
  loop: '{{ local_users }}'
  when:
  - item.value[2]|int &gt;= 1000
  - item.value[2]|int != 65534
  - item.value[2]|int &lt; 61184 or item.value[2]|int &gt; 65519
  - not item.value[4] | regex_search('^\/\w*\/\w{1,}')
  tags:
  - DISA-STIG-OL09-00-003002
  - accounts_user_interactive_home_directory_defined
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_user_interactive_home_directory_defined:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_user_interactive_home_directory_defined_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" severity="medium">
              <xccdf-1.2:title>All Interactive Users Home Directories Must Exist</xccdf-1.2:title>
              <xccdf-1.2:description>Create home directories to all local interactive users that currently do not
have a home directory assigned. Use the following commands to create the user
home directory assigned in <html:code>/etc/passwd</html:code>:
<html:pre>$ sudo mkdir /home/<html:i>USER</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271844r1092244_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If a local interactive user has a home directory defined that does not exist,
the user may be given access to the / directory as the current working directory
upon logon. This could create a Denial of Service because the user would not be
able to access their logon configuration files, and it may give them visibility
to system files they normally would not be able to access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_user_interactive_home_directory_exists" complexity="low" disruption="low" reboot="false" strategy="restrict">
for user in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $1}' /etc/passwd); do
    mkhomedir_helper $user 0077;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_user_interactive_home_directory_exists" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - DISA-STIG-OL09-00-003050
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - DISA-STIG-OL09-00-003050
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive users have a home directory exists
  ansible.builtin.user:
    name: '{{ item.key }}'
    create_home: true
  loop: '{{ local_users }}'
  when:
  - item.value[2]|int &gt;= 1000
  - item.value[2]|int != 65534
  tags:
  - DISA-STIG-OL09-00-003050
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_user_interactive_home_directory_exists:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_user_interactive_home_directory_exists_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership" severity="medium">
              <xccdf-1.2:title>All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group</xccdf-1.2:title>
              <xccdf-1.2:description>Change the group of a local interactive users files and directories to a
group that the interactive user is a member of. To change the group owner of a
local interactive users files and directories, use the following command:
<html:pre>$ sudo chgrp <html:i>USER_GROUP</html:i> /home/<html:i>USER</html:i>/<html:i>FILE_DIR</html:i>
        </html:pre>

This rule ensures every file or directory under the home directory related
to an interactive user is group-owned by an interactive user.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of folders or files in their respective home directories.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If a local interactive users files are group-owned by a group of which the
user is not a member, unintended users may be able to access them.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_users_home_files_groupownership" complexity="low" disruption="low" reboot="false" strategy="restrict">
for user in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534 &amp;&amp; $6 != "/") print $1 }' /etc/passwd); do
    home_dir=$(getent passwd $user | cut -d: -f6)
    group=$(getent passwd $user | cut -d: -f4)
    # Only update the group-ownership when necessary. This will avoid changing the inode timestamp
    # when the group is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find $home_dir -not -group $group -exec chgrp -f --no-dereference $group {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_users_home_files_groupownership" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - accounts_users_home_files_groupownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - accounts_users_home_files_groupownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - accounts_users_home_files_groupownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users are the owners of their respective home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    group: '{{ item.0.value[2] }}'
    recurse: true
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - accounts_users_home_files_groupownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_users_home_files_groupownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_users_home_files_groupownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership" severity="medium">
              <xccdf-1.2:title>All User Files and Directories In The Home Directory Must Have a Valid Owner</xccdf-1.2:title>
              <xccdf-1.2:description>Either remove all files and directories from the system that
do not have a valid user, or assign a valid user to all unowned
files and directories. To assign a valid owner to a local
interactive user's files and directories, use the following command:
<html:pre>$ sudo chown -R <html:i>USER</html:i> /home/<html:i>USER</html:i>
        </html:pre>

This rule ensures every file or directory under the home directory related
to an interactive user is owned by an interactive user.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the ownership of
folders or files in their respective home directories.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If local interactive users do not own the files in their directories,
unauthorized users may be able to access them. Additionally, if files are not
owned by the user, this could be an indication of system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_users_home_files_ownership" complexity="low" disruption="low" reboot="false" strategy="restrict">
for user in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534 &amp;&amp; $6 != "/") print $1 }' /etc/passwd); do
    home_dir=$(getent passwd $user | cut -d: -f6)
    # Only update the ownership when necessary. This will avoid changing the inode timestamp
    # when the owner is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find $home_dir -not -user $user -exec chown -f --no-dereference $user {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_users_home_files_ownership" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - accounts_users_home_files_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - accounts_users_home_files_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - accounts_users_home_files_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users are the owners of their respective home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    owner: '{{ item.0.value[1] }}'
    recurse: true
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - accounts_users_home_files_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_users_home_files_ownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_users_home_files_ownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions" severity="medium">
              <xccdf-1.2:title>All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive</xccdf-1.2:title>
              <xccdf-1.2:description>Set the mode on files and directories in the local interactive user home
directory with the following command:
<html:pre>$ sudo chmod 0750 /home/<html:i>USER</html:i>/<html:i>FILE_DIR</html:i>
        </html:pre>
Files that begin with a "." are excluded from this requirement.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If a local interactive user files have excessive permissions, unintended users
may be able to access or modify them.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_users_home_files_permissions" complexity="low" disruption="low" reboot="false" strategy="restrict">
for home_dir in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534 &amp;&amp; $6 != "/") print $6 }' /etc/passwd); do
    # Only update the permissions when necessary. This will avoid changing the inode timestamp when
    # the permission is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find "$home_dir" -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_users_home_files_permissions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - accounts_users_home_files_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - accounts_users_home_files_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence home directories to avoid creating them.
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - accounts_users_home_files_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users have proper permissions on their respective
    home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    mode: u-s,g-w-s,o=-
    follow: false
    recurse: true
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - accounts_users_home_files_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_users_home_files_permissions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_users_home_files_permissions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" severity="medium">
              <xccdf-1.2:title>All Interactive User Home Directories Must Be Group-Owned By The Primary Group</xccdf-1.2:title>
              <xccdf-1.2:description>Change the group owner of interactive users home directory to the
group found in <html:code>/etc/passwd</html:code>. To change the group owner of
interactive users home directory, use the following command:
<html:pre>$ sudo chgrp <html:i>USER_GROUP</html:i> /home/<html:i>USER</html:i>
        </html:pre>

This rule ensures every home directory related to an interactive user is
group-owned by an interactive user. It also ensures that interactive users
are group-owners of one and only one home directory.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective home directories.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002514</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271783r1092061_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the Group Identifier (GID) of a local interactive users home directory is
not the same as the primary GID of the user, this would allow unauthorized
access to the users files, and users that share the same group may not be
able to access files that they legitimately should.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_home_directories" complexity="low" disruption="low" reboot="false" strategy="restrict">
awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_home_directories" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - DISA-STIG-OL09-00-002514
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - DISA-STIG-OL09-00-002514
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    group ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  tags:
  - DISA-STIG-OL09-00-002514
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users are the group-owners of their respective home
    directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    group: '{{ item.0.value[2] }}'
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - DISA-STIG-OL09-00-002514
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupownership_home_directories:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupownership_home_directories_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" severity="medium">
              <xccdf-1.2:title>Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</xccdf-1.2:title>
              <xccdf-1.2:description>Set the mode of the user initialization files to <html:code>0740</html:code> with the
following command:
<html:pre>$ sudo chmod 0740 /home/<html:i>USER</html:i>/.<html:i>INIT_FILE</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002513</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271782r1092058_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Local initialization files are used to configure the user's shell environment
upon logon. Malicious modification of these files could compromise accounts upon
logon.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permission_user_init_files" complexity="low" disruption="low" reboot="false" strategy="restrict">
var_user_initialization_files_regex='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" use="legacy"/>'


readarray -t interactive_users &lt; &lt;(awk -F: '$3&gt;=1000   {print $1}' /etc/passwd)
readarray -t interactive_users_home &lt; &lt;(awk -F: '$3&gt;=1000   {print $6}' /etc/passwd)
readarray -t interactive_users_shell &lt; &lt;(awk -F: '$3&gt;=1000   {print $7}' /etc/passwd)

USERS_IGNORED_REGEX='nobody|nfsnobody'

for (( i=0; i&lt;"${#interactive_users[@]}"; i++ )); do
    if ! grep -qP "$USERS_IGNORED_REGEX" &lt;&lt;&lt; "${interactive_users[$i]}" &amp;&amp; \
        [ "${interactive_users_shell[$i]}" != "/sbin/nologin" ]; then
        
        readarray -t init_files &lt; &lt;(find "${interactive_users_home[$i]}" -maxdepth 1 \
            -exec basename {} \; | grep -P "$var_user_initialization_files_regex")
        for file in "${init_files[@]}"; do
            chmod u-s,g-wxs,o= "${interactive_users_home[$i]}/$file"
        done
    fi
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permission_user_init_files" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_user_initialization_files_regex # promote to variable
  set_fact:
    var_user_initialization_files_regex: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" use="legacy"/>
  tags:
    - always

- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Gather
    User Info
  ansible.builtin.getent:
    database: passwd
  tags:
  - DISA-STIG-OL09-00-002513
  - file_permission_user_init_files
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Find
    Init Files
  ansible.builtin.find:
    paths: '{{ item.value[4] }}'
    pattern: '{{ var_user_initialization_files_regex }}'
    hidden: true
    use_regex: true
  with_dict: '{{ ansible_facts.getent_passwd }}'
  when:
  - item.value[4] != "/sbin/nologin"
  - item.key not in ["nobody", "nfsnobody"]
  - item.value[1] | int &gt;= 1000
  register: found_init_files
  tags:
  - DISA-STIG-OL09-00-002513
  - file_permission_user_init_files
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Fix
    Init Files Permissions
  ansible.builtin.file:
    path: '{{ item.1.path }}'
    mode: u-s,g-wxs,o=
  loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'',
    {''skip_missing'': True}) }}'
  tags:
  - DISA-STIG-OL09-00-002513
  - file_permission_user_init_files
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_user_initialization_files_regex:var:1" value-id="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permission_user_init_files:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permission_user_init_files_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" severity="medium">
              <xccdf-1.2:title>All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</xccdf-1.2:title>
              <xccdf-1.2:description>Change the mode of interactive users home directories to <html:code>0750</html:code>. To
change the mode of interactive users home directory, use the
following command:
<html:pre>$ sudo chmod 0750 /home/<html:i>USER</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002515</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271784r1092064_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Excessive permissions on local interactive user home directories may allow
unauthorized access to user files by other users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_home_directories" complexity="low" disruption="low" reboot="false" strategy="restrict">
for home_dir in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534 &amp;&amp; $6 != "/") print $6 }' /etc/passwd); do
    # Only update the permissions when necessary. This will avoid changing the inode timestamp when
    # the permission is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find "$home_dir" -maxdepth 0 -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_home_directories" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - DISA-STIG-OL09-00-002515
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - DISA-STIG-OL09-00-002515
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence home directories to avoid creating them.
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - DISA-STIG-OL09-00-002515
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users have proper permissions on their respective
    home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    mode: u-s,g-w-s,o=-
    follow: false
    recurse: false
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - DISA-STIG-OL09-00-002515
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_home_directories:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_home_directories_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_home_dirs" severity="medium">
              <xccdf-1.2:title>Ensure that User Home Directories are not Group-Writable or World-Readable</xccdf-1.2:title>
              <xccdf-1.2:description>For each human user of the system, view the
permissions of the user's home directory:
<html:pre># ls -ld /home/<html:i>USER</html:i>
        </html:pre>
Ensure that the directory is not group-writable and that it
is not world-readable. If necessary, repair the permissions:
<html:pre># chmod g-w /home/<html:i>USER</html:i>
# chmod o-rwx /home/<html:i>USER</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">This action may involve modifying user home directories.
Notify your user community, and solicit input if appropriate,
before making this type of change.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">This rule is deprecated in favor of the <html:code>file_permissions_home_directories</html:code> rule.Please consider replacing this rule in your files as it is not expected to receive
updates as of version <html:code>0.1.62</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>User home directories contain many configuration files which
affect the behavior of a user's account. No user should ever have
write permission to another user's home directory. Group shared
directories can be configured in sub-directories or elsewhere in the
filesystem if they are needed. Typically, user home directories
should not be world-readable, as it would disclose file names
to other users. If a subset of users need read access
to one another's home directories, this can be provided using
groups or ACLs.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_home_dirs" complexity="low" disruption="low" reboot="false" strategy="restrict">
for home_dir in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534 &amp;&amp; $6 != "/") print $6 }' /etc/passwd); do
    # Only update the permissions when necessary. This will avoid changing the inode timestamp when
    # the permission is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find "$home_dir" -maxdepth 0 -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_home_dirs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - file_permissions_home_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - file_permissions_home_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence home directories to avoid creating them.
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - file_permissions_home_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users have proper permissions on their respective
    home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    mode: u-s,g-w-s,o=-
    follow: false
    recurse: false
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - file_permissions_home_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_home_dirs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_root_paths">
              <xccdf-1.2:title>Ensure that No Dangerous Directories Exist in Root's Path</xccdf-1.2:title>
              <xccdf-1.2:description>The active path of the root account can be obtained by
starting a new root shell and running:
<html:pre># echo $PATH</html:pre>
This will produce a colon-separated list of
directories in the path.
<html:br/>
        <html:br/>
Certain path elements could be considered dangerous, as they could lead
to root executing unknown or
untrusted programs, which could contain malicious
code.
Since root may sometimes work inside
untrusted directories, the <html:code>.</html:code> character, which represents the
current directory, should never be in the root path, nor should any
directory which can be written to by an unprivileged or
semi-privileged (system) user.
<html:br/>
        <html:br/>
It is a good practice for administrators to always execute
privileged commands by typing the full path to the
command.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" severity="medium">
                <xccdf-1.2:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</xccdf-1.2:title>
                <xccdf-1.2:description>For each element in root's path, run:
<html:pre># ls -ld <html:i>DIR</html:i>
         </html:pre>
and ensure that write permissions are disabled for group and
other.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_root_path_dirs_no_write" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Get root paths which are not symbolic links
  stat:
    path: '{{ item }}'
  changed_when: false
  failed_when: false
  register: root_paths
  with_items: '{{ ansible_env.PATH.split('':'') }}'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - accounts_root_path_dirs_no_write
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable writability to root directories
  file:
    path: '{{ item.item }}'
    mode: g-w,o-w
  with_items: '{{ root_paths.results }}'
  when:
  - root_paths.results is defined
  - item.stat.exists
  - not item.stat.islnk
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - accounts_root_path_dirs_no_write
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_root_path_dirs_no_write:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_root_path_no_dot" severity="unknown">
                <xccdf-1.2:title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</xccdf-1.2:title>
                <xccdf-1.2:description>Ensure that none of the directories in root's path is equal to a single
<html:code>.</html:code> character, or
that it contains any instances that lead to relative path traversal, such as
<html:code>..</html:code> or beginning a path without the slash (<html:code>/</html:code>) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
<html:pre>PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin</html:pre>
These empty elements have the same effect as a single <html:code>.</html:code> character.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Including these entries increases the risk that root could
execute code from an untrusted location.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-root_path_no_dot:def:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_user_umask">
              <xccdf-1.2:title>Ensure that Users Have Sensible Umask Values</xccdf-1.2:title>
              <xccdf-1.2:description>The umask setting controls the default permissions
for the creation of new files.
With a default <html:code>umask</html:code> setting of 077, files and directories
created by users will not be readable by any other user on the
system. Users who wish to make specific files group- or
world-readable can accomplish this by using the chmod command.
Additionally, users can make all their files readable to their
group by default by setting a <html:code>umask</html:code> of 027 in their shell
configuration files. If default per-user groups exist (that is, if
every user has a default group whose name is the same as that
user's username and whose only member is the user), then it may
even be safe for users to select a <html:code>umask</html:code> of 007, making it very
easy to intentionally share files with groups of which the user is
a member.
<html:br/>
        <html:br/>
       </xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_user_umask" type="string">
                <xccdf-1.2:title>Sensible umask</xccdf-1.2:title>
                <xccdf-1.2:description>Enter default user umask</xccdf-1.2:description>
                <xccdf-1.2:value selector="007">007</xccdf-1.2:value>
                <xccdf-1.2:value selector="022">022</xccdf-1.2:value>
                <xccdf-1.2:value selector="027">027</xccdf-1.2:value>
                <xccdf-1.2:value selector="077">077</xccdf-1.2:value>
                <xccdf-1.2:value>027</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" severity="medium">
                <xccdf-1.2:title>Ensure the Default Bash Umask is Set Correctly</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure the default umask for users of the Bash shell is set properly,
add or correct the <html:code>umask</html:code> setting in <html:code>/etc/bashrc</html:code> to read
as follows:
<html:pre>umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R36</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002301</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271693r1091791_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_bash"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_umask_etc_bashrc"># Remediation is applicable only in certain platforms
if rpm --quiet -q bash; then

var_accounts_user_umask='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'






grep -q "^[^#]*\bumask" /etc/bashrc &amp;&amp; \
  sed -i -E -e "s/^([^#]*\bumask)[[:space:]]+[[:digit:]]+/\1 $var_accounts_user_umask/g" /etc/bashrc
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" &gt;&gt; /etc/bashrc
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_etc_bashrc" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002301
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Check if umask in /etc/bashrc is already set
  ansible.builtin.lineinfile:
    path: /etc/bashrc
    regexp: ^[^#]*\bumask\s+\d+$
    state: absent
  check_mode: true
  changed_when: false
  register: umask_replace
  when: '"bash" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002301
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Replace user umask in /etc/bashrc
  ansible.builtin.replace:
    path: /etc/bashrc
    regexp: ^([^#]*\b)umask\s+\d+$
    replace: \g&lt;1&gt;umask {{ var_accounts_user_umask }}
  when:
  - '"bash" in ansible_facts.packages'
  - umask_replace.found &gt; 0
  tags:
  - DISA-STIG-OL09-00-002301
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default umask is Appended Correctly
  ansible.builtin.lineinfile:
    create: true
    path: /etc/bashrc
    line: umask {{ var_accounts_user_umask }}
  when:
  - '"bash" in ansible_facts.packages'
  - umask_replace.found == 0
  tags:
  - DISA-STIG-OL09-00-002301
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_umask_etc_bashrc:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_umask_etc_bashrc_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc" severity="medium">
                <xccdf-1.2:title>Ensure the Default C Shell Umask is Set Correctly</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure the default umask for users of the C shell is set properly,
add or correct the <html:code>umask</html:code> setting in <html:code>/etc/csh.cshrc</html:code> to read as follows:
<html:pre>umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002302</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271694r1091794_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_umask_etc_csh_cshrc">
var_accounts_user_umask='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'


grep -q "^\s*umask" /etc/csh.cshrc &amp;&amp; \
  sed -i -E -e "s/^(\s*umask).*/\1 $var_accounts_user_umask/g" /etc/csh.cshrc
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" &gt;&gt; /etc/csh.cshrc
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_etc_csh_cshrc" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Check if umask in /etc/csh.cshrc is already set
  ansible.builtin.lineinfile:
    path: /etc/csh.cshrc
    regexp: ^(\s*)umask\s+.*
    state: absent
  check_mode: true
  changed_when: false
  register: umask_replace
  tags:
  - DISA-STIG-OL09-00-002302
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_csh_cshrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Replace user umask in /etc/csh.cshrc
  ansible.builtin.replace:
    path: /etc/csh.cshrc
    regexp: ^(\s*)umask(\s+).*
    replace: \g&lt;1&gt;umask\g&lt;2&gt;{{ var_accounts_user_umask }}
  when: umask_replace.found &gt; 0
  tags:
  - DISA-STIG-OL09-00-002302
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_csh_cshrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default umask is Appended Correctly
  ansible.builtin.lineinfile:
    create: true
    path: /etc/csh.cshrc
    line: umask {{ var_accounts_user_umask }}
  when: umask_replace.found == 0
  tags:
  - DISA-STIG-OL09-00-002302
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_csh_cshrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_umask_etc_csh_cshrc:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_umask_etc_csh_cshrc_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" severity="medium">
                <xccdf-1.2:title>Ensure the Default Umask is Set Correctly in login.defs</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure the default umask controlled by <html:code>/etc/login.defs</html:code> is set properly,
add or correct the <html:code>UMASK</html:code> setting in <html:code>/etc/login.defs</html:code> to read as follows:
<html:pre>UMASK <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R36</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002304</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271696r1091800_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and
written to by unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_shadow-utils"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_umask_etc_login_defs"># Remediation is applicable only in certain platforms
if rpm --quiet -q shadow-utils; then

var_accounts_user_umask='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^UMASK")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_user_umask"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^UMASK\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^UMASK\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_etc_login_defs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002304
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Check if UMASK is already set
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: ^(\s*)UMASK\s+.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_umask_is_set
  when: '"shadow-utils" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002304
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Replace user UMASK in /etc/login.defs
  ansible.builtin.replace:
    path: /etc/login.defs
    regexp: ^(\s*)UMASK(\s+).*
    replace: \g&lt;1&gt;UMASK\g&lt;2&gt;{{ var_accounts_user_umask }}
  when:
  - '"shadow-utils" in ansible_facts.packages'
  - result_umask_is_set.found &gt; 0
  tags:
  - DISA-STIG-OL09-00-002304
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default UMASK is Appended Correctly
  ansible.builtin.lineinfile:
    create: true
    path: /etc/login.defs
    line: UMASK {{ var_accounts_user_umask }}
  when:
  - '"shadow-utils" in ansible_facts.packages'
  - result_umask_is_set.found == 0
  tags:
  - DISA-STIG-OL09-00-002304
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_umask_etc_login_defs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" severity="medium">
                <xccdf-1.2:title>Ensure the Default Umask is Set Correctly in /etc/profile</xccdf-1.2:title>
                <xccdf-1.2:description>To ensure the default umask controlled by <html:code>/etc/profile</html:code> is set properly,
add or correct the <html:code>umask</html:code> setting in <html:code>/etc/profile</html:code> to read as follows:
<html:pre>umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>

Note that <html:code>/etc/profile</html:code> also reads scrips within <html:code>/etc/profile.d</html:code> directory.
These scripts are also valid files to set umask value. Therefore, they should also be
considered during the check and properly remediated, if necessary.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R36</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002303</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271695r1091797_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_umask_etc_profile" complexity="low" disruption="low" reboot="false" strategy="restrict">
var_accounts_user_umask='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'


readarray -t profile_files &lt; &lt;(find /etc/profile.d/ -type f -name '*.sh' -or -name 'sh.local')

for file in "${profile_files[@]}" /etc/profile; do
  grep -qE '^[^#]*umask' "$file" &amp;&amp; sed -i -E "s/^(\s*umask\s*)[0-7]+/\1$var_accounts_user_umask/g" "$file"
done

if ! grep -qrE '^[^#]*umask' /etc/profile*; then
  echo "umask $var_accounts_user_umask" &gt;&gt; /etc/profile
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_etc_profile" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Locate Profile
    Configuration Files Where umask Is Defined
  ansible.builtin.find:
    paths:
    - /etc/profile.d
    patterns:
    - sh.local
    - '*.sh'
    contains: ^[\s]*umask\s+\d+
  register: result_profile_d_files
  tags:
  - DISA-STIG-OL09-00-002303
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Replace Existing
    umask Value in Files From /etc/profile.d
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: ^(\s*)umask\s+\d+
    replace: \1umask {{ var_accounts_user_umask }}
  loop: '{{ result_profile_d_files.files }}'
  register: result_umask_replaced_profile_d
  when: result_profile_d_files.matched
  tags:
  - DISA-STIG-OL09-00-002303
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Is
    Set in /etc/profile if Not Already Set Elsewhere
  ansible.builtin.lineinfile:
    create: true
    mode: 420
    path: /etc/profile
    line: umask {{ var_accounts_user_umask }}
  when: not result_profile_d_files.matched
  tags:
  - DISA-STIG-OL09-00-002303
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Value
    For All Existing umask Definition in /etc/profile
  ansible.builtin.replace:
    path: /etc/profile
    regexp: ^(\s*)umask\s+\d+
    replace: \1umask {{ var_accounts_user_umask }}
  register: result_umask_replaced_profile
  tags:
  - DISA-STIG-OL09-00-002303
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_umask_etc_profile:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_accounts_umask_interactive_users" severity="medium">
                <xccdf-1.2:title>Ensure the Default Umask is Set Correctly For Interactive Users</xccdf-1.2:title>
                <xccdf-1.2:description>Remove the <html:code>UMASK</html:code> environment variable from all interactive users initialization files.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-003060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271848r1092256_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The umask controls the default access mode assigned to newly created files. A
umask of 077 limits new files to mode 700 or less permissive. Although umask can
be represented as a four-digit number, the first digit representing special
access modes is typically ignored or required to be 0. This requirement
applies to the globally configured system defaults and the local interactive
user defaults for each account on the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="accounts_umask_interactive_users" complexity="low" disruption="low" reboot="false" strategy="restrict">
while IFS= read -r dir; do
    while IFS= read -r -d '' file; do
        if [ "$(basename $file)" != ".bash_history" ]; then
            sed -i 's/^\(\s*umask\s*\)/#\1/g' "$file"
        fi
    done &lt;   &lt;(find $dir -maxdepth 1 -type f -name ".*" -print0)
done &lt;   &lt;(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $6}' /etc/passwd)
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="accounts_umask_interactive_users" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure interactive local users are the owners of their respective initialization
    files
  ansible.builtin.shell:
    cmd: |-
      for dir in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $6}' /etc/passwd); do
        for file in $(find $dir -maxdepth 1 -type f -name ".*"); do
          if [ "$(basename $file)" != ".bash_history" ]; then
            sed -i 's/^\(\s*umask\s*\)/#\1/g' $file
          fi
        done
      done
  tags:
  - DISA-STIG-OL09-00-003060
  - accounts_umask_interactive_users
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-accounts_umask_interactive_users:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-accounts_umask_interactive_users_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_bootloader-grub2">
          <xccdf-1.2:title>GRUB2 bootloader configuration</xccdf-1.2:title>
          <xccdf-1.2:description>During the boot process, the boot loader is
responsible for starting the execution of the kernel and passing
options to it. The boot loader allows for the selection of
different kernels - possibly on different partitions or media.
The default Oracle Linux 9 boot loader for x86 systems is called GRUB2.
Options it can pass to the kernel include <html:i>single-user mode</html:i>, which
provides root access without any authentication, and the ability to
disable SELinux. To prevent local users from modifying the boot
parameters and endangering security, protect the boot loader configuration
with a password and ensure its configuration file's permissions
are set properly.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#grub2_and_system_with_kernel"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_l1tf_options" type="string">
            <xccdf-1.2:title>L1TF vulnerability mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Defines the L1TF vulneratility mitigations to employ.</xccdf-1.2:description>
            <xccdf-1.2:value>flush</xccdf-1.2:value>
            <xccdf-1.2:value selector="full">full</xccdf-1.2:value>
            <xccdf-1.2:value selector="full_force">full,force</xccdf-1.2:value>
            <xccdf-1.2:value selector="flush">flush</xccdf-1.2:value>
            <xccdf-1.2:value selector="flush_nosmt">flush,nosmt</xccdf-1.2:value>
            <xccdf-1.2:value selector="flush_nowarn">flush,nowarn</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mds_options" type="string">
            <xccdf-1.2:title>MDS vulnerability mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Defines the MDS vulneratility mitigation to employ.</xccdf-1.2:description>
            <xccdf-1.2:value>full</xccdf-1.2:value>
            <xccdf-1.2:value selector="full">full</xccdf-1.2:value>
            <xccdf-1.2:value selector="full_nosmt">full,nosmt</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" type="string" interactive="true">
            <xccdf-1.2:title>Confidence level on Hardware Random Number Generator</xccdf-1.2:title>
            <xccdf-1.2:description>Defines the level of trust on the hardware random number generators available in the
system and the percentage of entropy to credit.</xccdf-1.2:description>
            <xccdf-1.2:value>500</xccdf-1.2:value>
            <xccdf-1.2:value selector="500">500</xccdf-1.2:value>
            <xccdf-1.2:value selector="512">512</xccdf-1.2:value>
            <xccdf-1.2:value selector="1000">1000</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" type="string">
            <xccdf-1.2:title>Spec Store Bypass Mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>This controls how the Speculative Store Bypass (SSB) vulnerability is mitigated.</xccdf-1.2:description>
            <xccdf-1.2:value>prctl</xccdf-1.2:value>
            <xccdf-1.2:value selector="on">on</xccdf-1.2:value>
            <xccdf-1.2:value selector="auto">auto</xccdf-1.2:value>
            <xccdf-1.2:value selector="prctl">prctl</xccdf-1.2:value>
            <xccdf-1.2:value selector="seccomp">seccomp</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_disable_recovery" severity="medium">
            <xccdf-1.2:title>Disable Recovery Booting</xccdf-1.2:title>
            <xccdf-1.2:description>Oracle Linux 9 systems support an "recovery boot" option that can be used
to prevent services from being started. The <html:code>GRUB_DISABLE_RECOVERY</html:code>
configuration option in <html:code>/etc/default/grub</html:code> should be set to
<html:code>true</html:code> to disable the generation of recovery mode menu entries. It is
also required to change the runtime configuration, run:
<html:pre>$ sudo grubby --update-kernel=ALL</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Using recovery boot, the console user could disable auditing, firewalls,
or other services, weakening system security.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_disable_recovery" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if grep -q '^GRUB_DISABLE_RECOVERY=.*'  '/etc/default/grub' ; then
    sed -i 's/GRUB_DISABLE_RECOVERY=.*/GRUB_DISABLE_RECOVERY=true/' "/etc/default/grub"
else
    echo "GRUB_DISABLE_RECOVERY=true" &gt;&gt; '/etc/default/grub'
fi

grubby --update-kernel=ALL

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_disable_recovery" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_disable_recovery
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify GRUB_DISABLE_RECOVERY=true
  lineinfile:
    path: /etc/default/grub
    regexp: ^GRUB_DISABLE_RECOVERY=.*
    line: GRUB_DISABLE_RECOVERY=true
    state: present
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_disable_recovery
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_disable_recovery
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_disable_recovery:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_disable_recovery_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_enable_iommu_force" severity="unknown">
            <xccdf-1.2:title>IOMMU configuration directive</xccdf-1.2:title>
            <xccdf-1.2:description>On x86 architecture supporting VT-d, the IOMMU manages the access control policy between the hardware devices and some
    of the system critical units such as the memory.
To ensure that <html:code>iommu=force</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>iommu=force</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... iommu=force ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="iommu=force"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="functionality">Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities. Proper function and stability should be assessed before applying remediation to production systems.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R7</xccdf-1.2:reference>
            <xccdf-1.2:rationale>On x86 architectures, activating the I/OMMU prevents the system from arbitrary accesses potentially made by
    hardware devices.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_enable_iommu_force"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="force"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "iommu" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"iommu=[^\"]*\"(.*]\s*)/\1\"iommu=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"iommu=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-iommu.toml"
    fi
else

    grubby --update-kernel=ALL --args=iommu=force

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_enable_iommu_force" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_enable_iommu_force
  - low_disruption
  - medium_complexity
  - reboot_required
  - restrict_strategy
  - unknown_severity

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="iommu=force"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_enable_iommu_force
  - low_disruption
  - medium_complexity
  - reboot_required
  - restrict_strategy
  - unknown_severity
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_enable_iommu_force">[customizations.kernel]
append = "iommu=force"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_enable_iommu_force:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_init_on_alloc_argument" severity="medium">
            <xccdf-1.2:title>Configure kernel to zero out memory before allocation</xccdf-1.2:title>
            <xccdf-1.2:description>To configure the kernel to zero out memory before allocating it, add the
<html:code>init_on_alloc=1</html:code> argument to the default GRUB 2 command line.
To ensure that <html:code>init_on_alloc=1</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>init_on_alloc=1</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... init_on_alloc=1 ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="init_on_alloc=1"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">AVA_VAN.1</xccdf-1.2:reference>
            <xccdf-1.2:rationale>When the kernel configuration option <html:code>init_on_alloc</html:code> is enabled,
all page allocator and slab allocator memory will be zeroed when allocated,
eliminating many kinds of "uninitialized heap memory" flaws, effectively
preventing data leaks.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_init_on_alloc_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="1"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "init_on_alloc" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"init_on_alloc=[^\"]*\"(.*]\s*)/\1\"init_on_alloc=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"init_on_alloc=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-init_on_alloc.toml"
    fi
else

    grubby --update-kernel=ALL --args=init_on_alloc=1

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_init_on_alloc_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_init_on_alloc_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="init_on_alloc=1"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_init_on_alloc_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_init_on_alloc_argument">[customizations.kernel]
append = "init_on_alloc=1"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_init_on_alloc_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_init_on_alloc_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_l1tf_argument" severity="high">
            <xccdf-1.2:title>Configure L1 Terminal Fault mitigations</xccdf-1.2:title>
            <xccdf-1.2:description>L1 Terminal Fault (L1TF) is a hardware vulnerability which allows unprivileged
speculative access to data which is available in the Level 1 Data Cache when
the page table entry isn't present.

Select the appropriate mitigation by adding the argument
<html:code>l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>
       </html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>
       </html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>
       </html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/> ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>"</html:pre>

Since Linux Kernel 4.19 you can check the L1TF vulnerability state with the
following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/l1tf</html:code>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Enabling L1TF mitigations may impact performance of the system.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The L1TF vulnerability allows an attacker to bypass memory access security controls imposed
by the system or hypervisor. The L1TF vulnerability allows read access to any physical memory
location that is cached in the L1 Data Cache.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_l1tf_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

var_l1tf_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>'

expected_value="$var_l1tf_options"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "l1tf" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"l1tf=[^\"]*\"(.*]\s*)/\1\"l1tf=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"l1tf=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-l1tf.toml"
    fi
else

    grubby --update-kernel=ALL --args=l1tf=$var_l1tf_options

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_l1tf_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_l1tf_argument
  - high_severity
  - low_disruption
  - medium_complexity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_l1tf_options # promote to variable
  set_fact:
    var_l1tf_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="l1tf={{ var_l1tf_options }}"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_l1tf_argument
  - high_severity
  - low_disruption
  - medium_complexity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_l1tf_argument">[customizations.kernel]
append = "l1tf=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_l1tf_options" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_l1tf_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_l1tf_options"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_l1tf_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_mce_argument" severity="medium">
            <xccdf-1.2:title>Force kernel panic on uncorrected MCEs</xccdf-1.2:title>
            <xccdf-1.2:description>A Machine Check Exception is an error generated by the CPU itdetects an error
in itself, memory or I/O devices.
These errors may be corrected and generate a check log entry, if an error
cannot be corrected the kernel may panic or SIGBUS.

To force the kernel to panic on any uncorrected error reported by Machine Check
set the MCE tolerance to zero by adding <html:code>mce=0</html:code>
to the default GRUB 2 command line for the Linux operating system.
To ensure that <html:code>mce=0</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>mce=0</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... mce=0 ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="mce=0"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Allowing uncorrected errors to result on a SIGBUS may allow an attacker to continue
trying to exploit a vulnerability such as Rowhammer.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_mce_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="0"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "mce" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"mce=[^\"]*\"(.*]\s*)/\1\"mce=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"mce=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-mce.toml"
    fi
else

    grubby --update-kernel=ALL --args=mce=0

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_mce_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_mce_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="mce=0"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_mce_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_mce_argument">[customizations.kernel]
append = "mce=0"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_mce_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_mce_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_mds_argument" severity="medium">
            <xccdf-1.2:title>Configure Microarchitectural Data Sampling mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Microarchitectural Data Sampling (MDS) is a hardware vulnerability which allows unprivileged
speculative access to data which is available in various CPU internal buffers.

When performing store, load, L1 refill operations, processors write data into temporary
microarchitectural structures (buffers), and the data in the buffer can be forwarded to load
operations as an optimization.

Under certain conditions, data unrelated to the load operations can be speculatively
forwarded from the buffers to a disclosure gadget which allows in turn to infer the value
via a cache side channel attack.

Select the appropriate mitigation by adding the argument
<html:code>mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>
       </html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>
       </html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>
       </html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/> ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>"</html:pre>

Not all processors are affected by all variants of MDS, but the mitigation mechanism is
identical for all of them.

Since Linux Kernel 5.2 you can check whether the system is vulnerable or mitigated with the
following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/mds</html:code>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Enabling MDS mitigations will impact performance of the system, mainly by workloads with
high rates of user-kernel-user space transitions. For example, system calls, NMIs and interrupts.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The MDS vulnerability allows an attacker to sample data from internal CPU buffers.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_mds_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

var_mds_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>'

expected_value="$var_mds_options"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "mds" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"mds=[^\"]*\"(.*]\s*)/\1\"mds=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"mds=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-mds.toml"
    fi
else

    grubby --update-kernel=ALL --args=mds=$var_mds_options

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_mds_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_mds_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_mds_options # promote to variable
  set_fact:
    var_mds_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="mds={{ var_mds_options }}"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_mds_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_mds_argument">[customizations.kernel]
append = "mds=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_mds_options" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_mds_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_mds_options"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_mds_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_mds_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_nosmap_argument_absent" severity="medium">
            <xccdf-1.2:title>Ensure SMAP is not disabled during boot</xccdf-1.2:title>
            <xccdf-1.2:description>The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into
memory pages in the user space, it is enabled by default since Linux kernel 3.7.
But it could be disabled through kernel boot parameters.

Ensure that Supervisor Mode Access Prevention (SMAP) is not disabled by
the <html:code>nosmap</html:code> boot paramenter option.

Check that the line <html:pre>GRUB_CMDLINE_LINUX="..."</html:pre> within <html:code>/etc/default/grub</html:code>
doesn't contain the argument <html:code>nosmap</html:code>.
Run the following command to update command line for already installed kernels:
<html:pre># grubby --update-kernel=ALL --remove-args="nosmap"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R1</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling SMAP can facilitate exploitation of vulnerabilities caused by unintended access and
manipulation of data in the user space.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_nosmap_argument_absent"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    sed -i -E "/kargs\s*=\s*\[\s*\"nosmap=[^\"]*\"\s*]/{:a;N;/^\n$/ba;N;/match-architectures.*/d;}" "$KARGS_DIR/*.toml"
    sed -i -E -e "s/^(\s*kargs\s*=\s*\[.*)\"nosmap=[^\"]*\"[,[:space:]]*(.*]\s*)/\1\2/" -e "s/^(\s*kargs.*),\s*\]$/\1\]/" "$KARGS_DIR/*.toml"
else

grubby --update-kernel=ALL --remove-args=nosmap

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_nosmap_argument_absent" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_nosmap_argument_absent
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="nosmap"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_nosmap_argument_absent
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_nosmap_argument_absent:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_nosmap_argument_absent_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_nosmep_argument_absent" severity="medium">
            <xccdf-1.2:title>Ensure SMEP is not disabled during boot</xccdf-1.2:title>
            <xccdf-1.2:description>The SMEP is used to prevent the supervisor mode from executing user space code,
it is enabled by default since Linux kernel 3.0. But it could be disabled through
kernel boot parameters.

Ensure that Supervisor Mode Execution Prevention (SMEP) is not disabled by
the <html:code>nosmep</html:code> boot paramenter option.

Check that the line <html:pre>GRUB_CMDLINE_LINUX="..."</html:pre> within <html:code>/etc/default/grub</html:code>
doesn't contain the argument <html:code>nosmep</html:code>.
Run the following command to update command line for already installed kernels:
<html:pre># grubby --update-kernel=ALL --remove-args="nosmep"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R1</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling SMEP can facilitate exploitation of certain vulnerabilities because it allows
the kernel to unintentionally execute code in less privileged memory space.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_nosmep_argument_absent"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    sed -i -E "/kargs\s*=\s*\[\s*\"nosmep=[^\"]*\"\s*]/{:a;N;/^\n$/ba;N;/match-architectures.*/d;}" "$KARGS_DIR/*.toml"
    sed -i -E -e "s/^(\s*kargs\s*=\s*\[.*)\"nosmep=[^\"]*\"[,[:space:]]*(.*]\s*)/\1\2/" -e "s/^(\s*kargs.*),\s*\]$/\1\]/" "$KARGS_DIR/*.toml"
else

grubby --update-kernel=ALL --remove-args=nosmep

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_nosmep_argument_absent" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_nosmep_argument_absent
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="nosmep"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_nosmep_argument_absent
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_nosmep_argument_absent:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_nosmep_argument_absent_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_page_alloc_shuffle_argument" severity="medium">
            <xccdf-1.2:title>Enable randomization of the page allocator</xccdf-1.2:title>
            <xccdf-1.2:description>To enable randomization of the page allocator in the kernel, add the
<html:code>page_alloc.shuffle=1</html:code> argument to the default GRUB 2 command line.
To ensure that <html:code>page_alloc.shuffle=1</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>page_alloc.shuffle=1</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... page_alloc.shuffle=1 ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="page_alloc.shuffle=1"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">AVA_VAN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>CONFIG_SHUFFLE_PAGE_ALLOCATOR</html:code> config option is primarily
focused on improving the average utilization of a direct-mapped
memory-side-cache. Aside of this performance effect, it also reduces
predictability of page allocations in situations when the bad actor can
crash the system and somehow leverage knowledge of (page) allocation order
right after a fresh reboot, or can control the timing between a
hot-pluggable memory node (as in NUMA node) and applications allocating
memory ouf of that node. The <html:code>page_alloc.shuffle=1</html:code> kernel command
line parameter then forces this functionality irrespectively of memory cache
architecture.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_page_alloc_shuffle_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="1"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "page_alloc.shuffle" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"page_alloc.shuffle=[^\"]*\"(.*]\s*)/\1\"page_alloc.shuffle=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"page_alloc.shuffle=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-page_alloc_shuffle.toml"
    fi
else

    grubby --update-kernel=ALL --args=page_alloc.shuffle=1

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_page_alloc_shuffle_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_page_alloc_shuffle_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="page_alloc.shuffle=1"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_page_alloc_shuffle_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_page_alloc_shuffle_argument">[customizations.kernel]
append = "page_alloc.shuffle=1"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_page_alloc_shuffle_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_page_alloc_shuffle_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_pti_argument" severity="low">
            <xccdf-1.2:title>Enable Kernel Page-Table Isolation (KPTI)</xccdf-1.2:title>
            <xccdf-1.2:description>To enable Kernel page-table isolation,
add the argument <html:code>pti=on</html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>pti=on</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>pti=on</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... pti=on ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="pti=on"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002391</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271735r1091917_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Kernel page-table isolation is a kernel feature that mitigates
the Meltdown security vulnerability and hardens the kernel
against attempts to bypass kernel address space layout
randomization (KASLR).</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_pti_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="on"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "pti" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"pti=[^\"]*\"(.*]\s*)/\1\"pti=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"pti=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-pti.toml"
    fi
else

    grubby --update-kernel=ALL --args=pti=on

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_pti_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002391
  - NIST-800-53-SI-16
  - grub2_pti_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="pti=on"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - DISA-STIG-OL09-00-002391
  - NIST-800-53-SI-16
  - grub2_pti_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_pti_argument">[customizations.kernel]
append = "pti=on"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_pti_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_pti_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_rng_core_default_quality_argument" severity="low">
            <xccdf-1.2:title>Configure the confidence in TPM for entropy</xccdf-1.2:title>
            <xccdf-1.2:description>The TPM security chip that is available in most modern systems has a hardware RNG.
It is also used to feed the entropy pool, but generally not credited entropy.

Use <html:code>rng_core.default_quality</html:code> in the kernel command line to set the trust
level on the hardware generators. The trust level defines the amount of entropy to credit.
A value of <html:code>0</html:code> tells the system not to trust the hardware random number generators
available, and doesn't credit any entropy to the pool.
A value of <html:code>1000</html:code> assigns full confidence in the generators, and credits all the
entropy it provides to the pool.

Note that the value of <html:code>rng_core.default_quality</html:code> is global, affecting the trust
on all hardware random number generators.

Select the appropriate confidence by adding the argument
<html:code>rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>
       </html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>
       </html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>
       </html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/> ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>A system may struggle to initialize its entropy pool and end up starving. Crediting entropy
from the hardware number generators available in the system helps fill up the entropy pool.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_rng_core_default_quality_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

var_rng_core_default_quality='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>'

expected_value="$var_rng_core_default_quality"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "rng_core.default_quality" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"rng_core.default_quality=[^\"]*\"(.*]\s*)/\1\"rng_core.default_quality=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"rng_core.default_quality=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-rng_core_default_quality.toml"
    fi
else

    grubby --update-kernel=ALL --args=rng_core.default_quality=$var_rng_core_default_quality

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_rng_core_default_quality_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_rng_core_default_quality_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_rng_core_default_quality # promote to variable
  set_fact:
    var_rng_core_default_quality: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="rng_core.default_quality={{ var_rng_core_default_quality
    }}"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_rng_core_default_quality_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_rng_core_default_quality_argument">[customizations.kernel]
append = "rng_core.default_quality=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rng_core_default_quality" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_rng_core_default_quality:var:1" value-id="xccdf_org.ssgproject.content_value_var_rng_core_default_quality"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_rng_core_default_quality_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_rng_core_default_quality_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_slab_nomerge_argument" severity="medium">
            <xccdf-1.2:title>Disable merging of slabs with similar size</xccdf-1.2:title>
            <xccdf-1.2:description>The kernel may merge similar slabs together to reduce overhead and increase
cache hotness of objects.
Disabling merging of slabs keeps the slabs separate and reduces the risk of
kernel heap overflows overwriting objects in merged caches.

To disable merging of slabs in the Kernel add the argument <html:code>slab_nomerge=yes</html:code>
to the default GRUB 2 command line for the Linux operating system.
To ensure that <html:code>slab_nomerge=yes</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>slab_nomerge=yes</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... slab_nomerge=yes ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="slab_nomerge=yes"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Disabling merge of slabs will slightly increase kernel memory utilization.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling the merge of slabs of similar sizes prevents the kernel from
merging a seemingly useless but vulnerable slab with a useful and valuable slab.
This increase the risk that a heap overflow could overwrite objects from merged caches,
with unmerged caches the heap overflow would only affect the objects in the same cache.
Overall, this reduces the kernel attack surface area by isolating slabs from each other.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_slab_nomerge_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="yes"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "slab_nomerge" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"slab_nomerge=[^\"]*\"(.*]\s*)/\1\"slab_nomerge=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"slab_nomerge=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-slab_nomerge.toml"
    fi
else

    grubby --update-kernel=ALL --args=slab_nomerge=yes

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_slab_nomerge_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_slab_nomerge_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="slab_nomerge=yes"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_slab_nomerge_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_slab_nomerge_argument">[customizations.kernel]
append = "slab_nomerge=yes"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_slab_nomerge_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_slab_nomerge_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_spec_store_bypass_disable_argument" severity="medium">
            <xccdf-1.2:title>Configure Speculative Store Bypass Mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Certain CPUs are vulnerable to an exploit against a common wide industry wide performance
optimization known as Speculative Store Bypass (SSB).

In such cases, recent stores to the same memory location cannot always be observed by later
loads during speculative execution. However, such stores are unlikely and thus they can be
detected prior to instruction retirement at the end of a particular speculation execution
window.

Since Linux Kernel 4.17 you can check the SSB mitigation state with the following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass</html:code>

Select the appropriate SSB state by adding the argument
<html:code>spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>
       </html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>
       </html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>
       </html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/> ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">Disabling Speculative Store Bypass may impact performance of the system.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In vulnerable processsors, the speculatively forwarded store can be used in a cache side channel
attack. An example of this is reading memory to which the attacker does not directly have access,
for example inside the sandboxed code.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_spec_store_bypass_disable_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

var_spec_store_bypass_disable_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>'

expected_value="$var_spec_store_bypass_disable_options"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "spec_store_bypass_disable" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"spec_store_bypass_disable=[^\"]*\"(.*]\s*)/\1\"spec_store_bypass_disable=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"spec_store_bypass_disable=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-spec_store_bypass_disable.toml"
    fi
else

    grubby --update-kernel=ALL --args=spec_store_bypass_disable=$var_spec_store_bypass_disable_options

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_spec_store_bypass_disable_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_spec_store_bypass_disable_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_spec_store_bypass_disable_options # promote to variable
  set_fact:
    var_spec_store_bypass_disable_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="spec_store_bypass_disable={{ var_spec_store_bypass_disable_options
    }}"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_spec_store_bypass_disable_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_spec_store_bypass_disable_argument">[customizations.kernel]
append = "spec_store_bypass_disable=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options" use="legacy"/>"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_spec_store_bypass_disable_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_spec_store_bypass_disable_options"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_spec_store_bypass_disable_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_spec_store_bypass_disable_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_spectre_v2_argument" severity="high">
            <xccdf-1.2:title>Enforce Spectre v2 mitigation</xccdf-1.2:title>
            <xccdf-1.2:description>Spectre V2 is an indirect branch poisoning attack that can lead to data leakage.
An exploit for Spectre V2 tricks the indirect branch predictor into executing
code from a future indirect branch chosen by the attacker, even if the privilege
level is different.

Since Linux Kernel 4.15 you can check the Spectre V2 mitigation state with the following command:
<html:code>cat /sys/devices/system/cpu/vulnerabilities/spectre_v2</html:code>

Enforce the Spectre V2 mitigation by adding the argument
<html:code>spectre_v2=on</html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>spectre_v2=on</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>spectre_v2=on</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... spectre_v2=on ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="spectre_v2=on"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The Spectre V2 vulnerability allows an attacker to read memory that he should not have
access to.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_spectre_v2_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

expected_value="on"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "spectre_v2" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"spectre_v2=[^\"]*\"(.*]\s*)/\1\"spectre_v2=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"spectre_v2=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-spectre_v2.toml"
    fi
else

    grubby --update-kernel=ALL --args=spectre_v2=on

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_spectre_v2_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_spectre_v2_argument
  - high_severity
  - low_disruption
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="spectre_v2=on"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_spectre_v2_argument
  - high_severity
  - low_disruption
  - medium_complexity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_spectre_v2_argument">[customizations.kernel]
append = "spectre_v2=on"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_spectre_v2_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_spectre_v2_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_systemd_debug-shell_argument_absent" severity="medium">
            <xccdf-1.2:title>Ensure debug-shell service is not enabled during boot</xccdf-1.2:title>
            <xccdf-1.2:description>systemd's <html:code>debug-shell</html:code> service is intended to
diagnose systemd related boot issues with various <html:code>systemctl</html:code>
commands. Once enabled and following a system reboot, the root shell
will be available on <html:code>tty9</html:code> which is access by pressing
<html:code>CTRL-ALT-F9</html:code>. The <html:code>debug-shell</html:code> service should only be used
for systemd related issues and should otherwise be disabled.
<html:br/>
       <html:br/>
By default, the <html:code>debug-shell</html:code> systemd service is already disabled.

Ensure the debug-shell is not enabled by the <html:code>systemd.debug-shel=1</html:code>
boot parameter option.

Check that the line <html:pre>GRUB_CMDLINE_LINUX="..."</html:pre> within <html:code>/etc/default/grub</html:code>
doesn't contain the argument <html:code>systemd.debug-shell</html:code>.
Run the following command to update command line for already installed kernels:
<html:pre># grubby --update-kernel=ALL --remove-args="systemd.debug-shell"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This prevents attackers with physical access from trivially bypassing security
on the machine through valid troubleshooting configurations and gaining root
access when the system is rebooted.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_systemd_debug-shell_argument_absent"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    sed -i -E "/kargs\s*=\s*\[\s*\"systemd.debug-shell=[^\"]*\"\s*]/{:a;N;/^\n$/ba;N;/match-architectures.*/d;}" "$KARGS_DIR/*.toml"
    sed -i -E -e "s/^(\s*kargs\s*=\s*\[.*)\"systemd.debug-shell=[^\"]*\"[,[:space:]]*(.*]\s*)/\1\2/" -e "s/^(\s*kargs.*),\s*\]$/\1\]/" "$KARGS_DIR/*.toml"
else

grubby --update-kernel=ALL --remove-args=systemd.debug-shell

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_systemd_debug-shell_argument_absent" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - grub2_systemd_debug-shell_argument_absent
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="systemd.debug-shell"
  when: ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - grub2_systemd_debug-shell_argument_absent
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_systemd_debug-shell_argument_absent:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_systemd_debug-shell_argument_absent_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" severity="medium">
            <xccdf-1.2:title>Disable vsyscalls</xccdf-1.2:title>
            <xccdf-1.2:description>To disable use of virtual syscalls,
add the argument <html:code>vsyscall=none</html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>vsyscall=none</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>vsyscall=none</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... vsyscall=none ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="vsyscall=none"</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">The vsyscall emulation is only available on x86_64 architecture
(CONFIG_X86_VSYSCALL_EMULATION) making this rule not applicable
to other CPU architectures.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_ASLR_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002393</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271737r1094967_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Virtual Syscalls provide an opportunity of attack for a user who has control
of the return instruction pointer.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#x86_64_arch"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_vsyscall_argument"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; { ( grep -sqE "^.*\.x86_64$" /proc/sys/kernel/osrelease || grep -sqE "^x86_64$" /proc/sys/kernel/arch; ); }; then

expected_value="none"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "vsyscall" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"vsyscall=[^\"]*\"(.*]\s*)/\1\"vsyscall=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"vsyscall=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-vsyscall.toml"
    fi
else

    grubby --update-kernel=ALL --args=vsyscall=none

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_vsyscall_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002393
  - NIST-800-53-CM-7(a)
  - grub2_vsyscall_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="vsyscall=none"
  when:
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-002393
  - NIST-800-53-CM-7(a)
  - grub2_vsyscall_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_vsyscall_argument">[customizations.kernel]
append = "vsyscall=none"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_vsyscall_argument:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_vsyscall_argument_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_non-uefi">
            <xccdf-1.2:title>Non-UEFI GRUB2 bootloader configuration</xccdf-1.2:title>
            <xccdf-1.2:description>Non-UEFI GRUB2 bootloader configuration</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#non-uefi"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/grub.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code>root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/grub2/grub.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002530</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271792r1094968_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ ! -d /sys/firmware/efi ] &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

chgrp 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002530
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002530
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: '0'
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002530
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/user.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/user.cfg</html:code> should be group-owned by the <html:code>root</html:code>
group to prevent reading or modification of the file.

To properly set the group owner of <html:code>/boot/grub2/user.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/grub2/user.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway. Non-root users who read the boot parameters
may be able to identify weaknesses in security upon boot and be able to exploit them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ ! -d /sys/firmware/efi ] &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

chgrp 0 /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/user.cfg
  file:
    path: /boot/grub2/user.cfg
    group: '0'
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_user_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_user_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/grub.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code>root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chown root /boot/grub2/grub.cfg </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002531</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271793r1092605_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Only root should be able to modify important boot parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ ! -d /sys/firmware/efi ] &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

chown 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002531
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002531
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: '0'
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002531
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_user_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/user.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/user.cfg</html:code> should be owned by the <html:code>root</html:code>
user to prevent reading or modification of the file.

To properly set the owner of <html:code>/boot/grub2/user.cfg</html:code>, run the command:
<html:pre>$ sudo chown root /boot/grub2/user.cfg </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Only root should be able to modify important boot parameters. Also, non-root users who read
the boot parameters may be able to identify weaknesses in security upon boot and be able to
exploit them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ ! -d /sys/firmware/efi ] &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

chown 0 /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/user.cfg
  file:
    path: /boot/grub2/user.cfg
    owner: '0'
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_user_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_user_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/grub.cfg Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>File permissions for <html:code>/boot/grub2/grub.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chmod 600 /boot/grub2/grub.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Proper permissions ensure that only the root user can modify important boot
parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ ! -d /sys/firmware/efi ] &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

chmod u-xs,g-xwrs,o-xwrt /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_user_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/user.cfg Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>File permissions for <html:code>/boot/grub2/user.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code>/boot/grub2/user.cfg</html:code>, run the command:
<html:pre>$ sudo chmod 600 /boot/grub2/user.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Proper permissions ensure that only the root user can read or modify important boot
parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_bootc"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ ! -d /sys/firmware/efi ] &amp;&amp; { ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ); }; then

chmod u-xs,g-xwrs,o-xwrt /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /boot/grub2/user.cfg
  file:
    path: /boot/grub2/user.cfg
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_user_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_user_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_admin_username" severity="high">
              <xccdf-1.2:title>Set the Boot Loader Admin Username to a Non-Default Value</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/>
        <html:br/>
To maximize the protection, select a password-protected superuser account with unique name, and modify the
<html:code>/etc/grub.d/01_users</html:code> configuration file to reflect the account name change.
<html:br/>
        <html:br/>
Do not to use common administrator account names like root,
admin, or administrator for the grub2 superuser account.
<html:br/>
        <html:br/>
Change the superuser to a different username (The default is 'root').
<html:pre>$ sed -i 's/\(set superusers=\).*/\1"&lt;unique user ID&gt;"/g' /etc/grub.d/01_users</html:pre>
        <html:br/>
        <html:br/>
Once the superuser account has been added,
update the
<html:code>grub.cfg</html:code> file by running:
<html:pre>grubby --update-kernel=ALL</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded admin usernames, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271451r1091065_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Having a non-default grub superuser username makes password-guessing attacks less effective.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_admin_username:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_admin_username_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_password" severity="high">
              <xccdf-1.2:title>Set Boot Loader Password in grub2</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/>
        <html:br/>
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:

<html:pre># grub2-setpassword</html:pre>

When prompted, enter the password that was selected.
<html:br/>
        <html:br/>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-001115</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271635r1091617_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_password:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_password_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_uefi">
            <xccdf-1.2:title>UEFI GRUB2 bootloader configuration</xccdf-1.2:title>
            <xccdf-1.2:description>UEFI GRUB2 bootloader configuration</xccdf-1.2:description>
            <xccdf-1.2:warning category="functionality">UEFI generally uses vfat file systems, which does not support Unix-style permissions
managed by chmod command. In this case, in order to change file permissions for files
within /boot/efi it is necessary to update the mount options in /etc/fstab file and
reboot the system.</xccdf-1.2:warning>
            <xccdf-1.2:platform idref="#uefi"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code>root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/grub2/grub.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ -d /sys/firmware/efi ]; then

chgrp 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_groupowner_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_groupowner_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: '0'
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_groupowner_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_efi_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_efi_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/user.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/user.cfg</html:code> should be group-owned by the
<html:code>root</html:code> group to prevent reading or modification of the file.

To properly set the group owner of <html:code>/boot/grub2/user.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/grub2/user.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway. Non-root users who read the boot parameters
may be able to identify weaknesses in security upon boot and be able to exploit them.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_efi_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ -d /sys/firmware/efi ]; then

chgrp 0 /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_efi_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_groupowner_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_groupowner_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/user.cfg
  file:
    path: /boot/grub2/user.cfg
    group: '0'
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_groupowner_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_efi_user_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_efi_user_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify the UEFI Boot Loader grub.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code>root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chown root /boot/grub2/grub.cfg </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Only root should be able to modify important boot parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ -d /sys/firmware/efi ]; then

chown 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_owner_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_owner_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: '0'
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_owner_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_efi_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_efi_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/user.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/boot/grub2/user.cfg</html:code> should be owned by the <html:code>root</html:code>
user to prevent reading or modification of the file.

To properly set the owner of <html:code>/boot/grub2/user.cfg</html:code>, run the command:
<html:pre>$ sudo chown root /boot/grub2/user.cfg </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Only root should be able to modify important boot parameters. Also, non-root users who read
the boot parameters may be able to identify weaknesses in security upon boot and be able to
exploit them.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_efi_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ -d /sys/firmware/efi ]; then

chown 0 /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_efi_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_owner_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_owner_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/user.cfg
  file:
    path: /boot/grub2/user.cfg
    owner: '0'
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - configure_strategy
  - file_owner_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_efi_user_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_efi_user_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg" severity="medium">
              <xccdf-1.2:title>Verify the UEFI Boot Loader grub.cfg Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>File permissions for <html:code>/boot/grub2/grub.cfg</html:code> should be set to 700.

To properly set the permissions of <html:code>/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chmod 700 /boot/grub2/grub.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Proper permissions ensure that only the root user can modify important boot
parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ -d /sys/firmware/efi ]; then

chmod u-s,g-xwrs,o-xwrt /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_efi_grub2_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-xwrs,o-xwrt on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    mode: u-s,g-xwrs,o-xwrt
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_efi_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_efi_grub2_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_efi_grub2_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg" severity="medium">
              <xccdf-1.2:title>Verify /boot/grub2/user.cfg Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>File permissions for <html:code>/boot/grub2/user.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code>/boot/grub2/user.cfg</html:code>, run the command:
<html:pre>$ sudo chmod 600 /boot/grub2/user.cfg</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Proper permissions ensure that only the root user can read or modify important boot
parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_efi_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; [ -d /sys/firmware/efi ]; then

chmod u-s,g-xwrs,o-xwrt /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_efi_user_cfg" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-xwrs,o-xwrt on /boot/grub2/user.cfg
  file:
    path: /boot/grub2/user.cfg
    mode: u-s,g-xwrs,o-xwrt
  when:
  - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
  - ( "grub2-common" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_efi_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_efi_user_cfg:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_efi_user_cfg_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_uefi_password" severity="high">
              <xccdf-1.2:title>Set the UEFI Boot Loader Password</xccdf-1.2:title>
              <xccdf-1.2:description>The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
<html:br/>
        <html:br/>
Since plaintext passwords are a security risk, generate a hash for the password
by running the following command:

<html:pre># grub2-setpassword</html:pre>

When prompted, enter the password that was selected.
<html:br/>
        <html:br/>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.

Also, do NOT manually add the superuser account and password to the
<html:code>grub.cfg</html:code> file as the grub2-mkconfig command overwrites this file.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000213</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000080-GPOS-00048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_uefi_password:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_uefi_password_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_entropy">
          <xccdf-1.2:title>Protect Random-Number Entropy Pool</xccdf-1.2:title>
          <xccdf-1.2:description>The I/O operations of the Linux kernel block layer due to their inherently
unpredictable execution times have been traditionally considered as a reliable
source to contribute to random-number entropy pool of the Linux kernel. This
has changed with introduction of solid-state storage devices (SSDs) though.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#machine"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_disable_entropy_contribution_for_solid_state_drives" severity="medium">
            <xccdf-1.2:title>Ensure Solid State Drives Do Not Contribute To Random-Number Entropy Pool</xccdf-1.2:title>
            <xccdf-1.2:description>For each solid-state drive on the system, run:
<html:pre> # echo 0 &gt; /sys/block/DRIVE/queue/add_random</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:rationale>In contrast to traditional electromechanical magnetic disks, containing
spinning disks and / or movable read / write heads, the solid-state storage
devices (SSDs) do not contain moving / mechanical components. Therefore the
I/O operation completion times are much more predictable for them.</xccdf-1.2:rationale>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_kernel_build_config">
          <xccdf-1.2:title>Kernel Configuration</xccdf-1.2:title>
          <xccdf-1.2:description>Contains rules that check the kernel configuration that was used to build it.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash" type="string">
            <xccdf-1.2:title>Hash function for kernel module signing</xccdf-1.2:title>
            <xccdf-1.2:description>The hash function to use when signing modules during kernel build process.</xccdf-1.2:description>
            <xccdf-1.2:value>sha512</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha1">sha1</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha224">sha224</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha256">sha256</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha384">sha384</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha512">sha512</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key" type="string" interactive="true">
            <xccdf-1.2:title>Key and certificate for kernel module signing</xccdf-1.2:title>
            <xccdf-1.2:description>The private key and certificate to use when signing modules during kernel build process.
On systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by RFC7512
In the latter case, the PKCS#11 URI should reference both a certificate and a private key.</xccdf-1.2:description>
            <xccdf-1.2:value>certs/signing_key.pem</xccdf-1.2:value>
            <xccdf-1.2:value selector="kernel_default">certs/signing_key.pem</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout" type="string" interactive="true">
            <xccdf-1.2:title>Kernel panic timeout</xccdf-1.2:title>
            <xccdf-1.2:description>The time, in seconds, to wait until a reboot occurs.
If the value is <html:code>0</html:code> the system never reboots.
If the value is less than <html:code>0</html:code> the system reboots immediately.</xccdf-1.2:description>
            <xccdf-1.2:value>0</xccdf-1.2:value>
            <xccdf-1.2:value selector="never">0</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="1_minute">60</xccdf-1.2:value>
            <xccdf-1.2:value selector="immediately">-1</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_acpi_custom_method" severity="low">
            <xccdf-1.2:title>Do not allow ACPI methods to be inserted/replaced at run time</xccdf-1.2:title>
            <xccdf-1.2:description>This debug facility allows ACPI AML methods to be inserted and/or replaced without rebooting
the system.
This configuration is available from kernel 3.0.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_ACPI_CUSTOM_METHOD</html:code>, run the following command:
    <html:code>grep CONFIG_ACPI_CUSTOM_METHOD /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Enabling this feature allows arbitrary kernel memory to be written to by root (uid=0) users,
allowing them to bypass certain security measures</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_acpi_custom_method:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_acpi_custom_method_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_arm64_sw_ttbr0_pan" severity="medium">
            <xccdf-1.2:title>Emulate Privileged Access Never (PAN)</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling this option prevents the kernel from accessing user-space memory directly by pointing
TTBR0_EL1 to a reserved zeroed area and reserved ASID.
The user access routines restore the valid TTBR0_EL1 temporarily.
This configuration is available from kernel 4.10, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_ARM64_SW_TTBR0_PAN</html:code>, run the following command:
    <html:code>grep CONFIG_ARM64_SW_TTBR0_PAN /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R27</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The Privileged Access Never (PAN) is the ARM equivalent of the x86 Supervisor Mode Access
Prevention (SMAP), and it prevents privileged acccess to user data unless explicitly enabled.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#aarch64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_arm64_sw_ttbr0_pan:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_binfmt_misc" severity="medium">
            <xccdf-1.2:title>Disable kernel support for MISC binaries</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling <html:code>CONFIG_BINFMT_MISC</html:code> makes it possible to plug wrapper-driven binary formats
into the kernel. This is specially useful for programs that need an interpreter to run like
Java, Python and DOS emulators. Once you have registered such a binary class with the kernel,
you can start one of those programs simply by typing in its name at a shell prompt.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_BINFMT_MISC</html:code>, run the following command:
    <html:code>grep CONFIG_BINFMT_MISC /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R23</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This disables arbitrary binary format support and helps reduce attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_binfmt_misc:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_bug" severity="medium">
            <xccdf-1.2:title>Enable support for BUG()</xccdf-1.2:title>
            <xccdf-1.2:description>Disabling this option eliminates support for BUG and WARN, reducing the size of your kernel
image and potentially quietly ignoring numerous fatal conditions. You should only consider
disabling this option for embedded systems with no facilities for reporting errors.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_BUG</html:code>, run the following command:
    <html:code>grep CONFIG_BUG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R19</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Not setting this variable may hide a number of critical errors.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_bug:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_bug_on_data_corruption" severity="low">
            <xccdf-1.2:title>Trigger a kernel BUG when data corruption is detected</xccdf-1.2:title>
            <xccdf-1.2:description>This option makes the kernel BUG when it encounters data corruption in kernel memory structures
when they get checked for validity.
This configuration is available from kernel 4.10.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_BUG_ON_DATA_CORRUPTION</html:code>, run the following command:
    <html:code>grep CONFIG_BUG_ON_DATA_CORRUPTION /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R16</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This helps detect data corruptions early and stop with a BUG() error message.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_bug_on_data_corruption:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_bug_on_data_corruption_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_compat_brk" severity="medium">
            <xccdf-1.2:title>Disable compatibility with brk()</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling compatiliby with <html:code>brk()</html:code> allows legacy binaries to run (i.e. those linked
against libc5). But this compatibility comes at the cost of not being able to randomize
the heap placement (ASLR).

Unless legacy binaries need to run on the system, set <html:code>CONFIG_COMPAT_BRK</html:code> to <html:code>"n"</html:code>.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_COMPAT_BRK</html:code>, run the following command:
    <html:code>grep CONFIG_COMPAT_BRK /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Enabling compatibility with brk() disables support for ASLR.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_compat_brk:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_compat_brk_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_compat_vdso" severity="low">
            <xccdf-1.2:title>Disable the 32-bit vDSO</xccdf-1.2:title>
            <xccdf-1.2:description>Certain buggy versions of glibc (2.3.3) will crash if they are presented with a 32-bit vDSO
that is not mapped at the address indicated in its segment table.
Setting <html:code>CONFIG_COMPAT_VDSO</html:code> to <html:code>y</html:code> turns off the 32-bit VDSO and works
aroud the glibc bug.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_COMPAT_VDSO</html:code>, run the following command:
    <html:code>grep CONFIG_COMPAT_VDSO /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Enabling VDSO compatibility hurts performance and disables ASLR.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_compat_vdso:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_compat_vdso_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_credentials" severity="low">
            <xccdf-1.2:title>Enable checks on credential management</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to turn on some debug checking for credential management. The additional code keeps
track of the number of pointers from task_structs to any given cred struct, and checks to see
that this number never exceeds the usage count of the cred struct.

Furthermore, if SELinux is enabled, this also checks that the security pointer in the cred
struct is never seen to be invalid.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_CREDENTIALS</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_CREDENTIALS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R16</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This adds sanity checks and validations to credential data structures.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_debug_credentials:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_debug_credentials_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_fs" severity="low">
            <xccdf-1.2:title>Disable kernel debugfs</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>debugfs</html:code> is a virtual file system that kernel developers use to put debugging files
into. Enable this option to be able to read and write to these files.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_FS</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_FS /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>To reduce the attack surface, this file system should be disabled if not in use.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_debug_fs:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_debug_fs_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_list" severity="low">
            <xccdf-1.2:title>Enable checks on linked list manipulation</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to turn on extended checks in the linked-list walking routines.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_LIST</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_LIST /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R16</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This add sanity checks to manipulation of linked lists structures in the kernel and may
prevent exploits such as CVE-2017-1661, where a race condition and simultaneos operations
caused a list to corrupt.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_debug_list:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_debug_list_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_notifiers" severity="low">
            <xccdf-1.2:title>Enable checks on notifier call chains</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to turn on sanity checking for notifier call chains. This is most useful for kernel
developers to make sure that modules properly unregister themselves from notifier chains.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_NOTIFIERS</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_NOTIFIERS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R16</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This provides validation of notifier chains, it checks whether the notifiers are from the
kernel or a module that is still loaded prior to being invoked.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_debug_notifiers:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_debug_notifiers_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_sg" severity="low">
            <xccdf-1.2:title>Enable checks on scatter-gather (SG) table operations</xccdf-1.2:title>
            <xccdf-1.2:description>Scatter-gather tables are mechanism used for high performance I/O on DMA devices.
Enable this to turn on checks on scatter-gather tables.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_SG</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_SG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R16</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This can help find problems with drivers that do not properly initialize their SG tables.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_debug_sg:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_debug_sg_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_debug_wx" severity="medium">
            <xccdf-1.2:title>Warn on W+X mappings found at boot</xccdf-1.2:title>
            <xccdf-1.2:description>Generate a warning if any W+X mappings are found at boot.
This configuration is available from kernel 5.8.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEBUG_WX</html:code>, run the following command:
    <html:code>grep CONFIG_DEBUG_WX /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This is useful for discovering cases where the kernel is leaving W+X mappings after applying NX,
as such mappings are a security risk.
Note that even if the check fails, your kernel is possibly still fine, as W+X mappings are not
a security hole in themselves, what they do is that they make the exploitation of other unfixed
kernel bugs easier.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_debug_wx:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_debug_wx_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_default_mmap_min_addr" severity="medium">
            <xccdf-1.2:title>Configure Low Address Space To Protect From User Allocation</xccdf-1.2:title>
            <xccdf-1.2:description>This is the portion of low virtual memory which should be protected from userspace allocation.
This configuration is available from kernel 3.14, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
To check the configuration value for <html:code>CONFIG_DEFAULT_MMAP_MIN_ADDR</html:code>, run the following command:
<html:code>grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config-*</html:code>
For each kernel installed, a line with value should be returned.
If the system architecture is x86_64, the value should be 65536.
If the system architecture is aarch64, the value should be 32768.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R25</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R27</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Keeping a user from writing to low pages can help reduce the impact of kernel NULL pointer bugs.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#aarch64_arch_or_x86_64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_default_mmap_min_addr:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_default_mmap_min_addr_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_devkmem" severity="low">
            <xccdf-1.2:title>Disable /dev/kmem virtual device support</xccdf-1.2:title>
            <xccdf-1.2:description>Disable support for the /dev/kmem device.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_DEVKMEM</html:code>, run the following command:
    <html:code>grep CONFIG_DEVKMEM /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The /dev/kmem device is rarely used, but can be used for certain kind of kernel debugging
operations.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_devkmem:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_devkmem_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_fortify_source" severity="medium">
            <xccdf-1.2:title>Harden common str/mem functions against buffer overflows</xccdf-1.2:title>
            <xccdf-1.2:description>Detect overflows of buffers in common string and memory functions where the compiler can
determine and validate the buffer sizes.
This configuration is available from kernel 4.13, but may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_FORTIFY_SOURCE</html:code>, run the following command:
    <html:code>grep CONFIG_FORTIFY_SOURCE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This features helps reduce likelihood of memory corruption of kernel structures.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_fortify_source:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_fortify_source_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy" severity="high">
            <xccdf-1.2:title>Harden memory copies between kernel and userspace</xccdf-1.2:title>
            <xccdf-1.2:description>This option checks for obviously wrong memory regions when copying memory to/from the kernel
(via copy_to_user() and copy_from_user() functions) by rejecting memory ranges that are larger
than the specified heap object, span multiple separately allocated pages, are not on the
process stack, or are part of the kernel text.
This configuration is available from kernel 4.8, and may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_HARDENED_USERCOPY</html:code>, run the following command:
    <html:code>grep CONFIG_HARDENED_USERCOPY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.
</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_hardened_usercopy:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_hardened_usercopy_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_hardened_usercopy_fallback" severity="high">
            <xccdf-1.2:title>Do not allow usercopy whitelist violations to fallback to object size</xccdf-1.2:title>
            <xccdf-1.2:description>This is a temporary option that allows missing usercopy whitelists to be discovered via a WARN()
to the kernel log, instead of rejecting the copy, falling back to non-whitelisted hardened
usercopy that checks the slab allocation size instead of the whitelist size.
This configuration is available from kernel 4.16.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_HARDENED_USERCOPY_FALLBACK</html:code>, run the following command:
    <html:code>grep CONFIG_HARDENED_USERCOPY_FALLBACK /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This config prevents entire classes of heap overflow exploits and similar kernel memory exposures.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_hardened_usercopy_fallback:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_hardened_usercopy_fallback_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_hibernation" severity="medium">
            <xccdf-1.2:title>Disable hibernation</xccdf-1.2:title>
            <xccdf-1.2:description>Enable the suspend to disk (STD) functionality, which is usually called "hibernation" in user
interfaces. STD checkpoints the system and powers it off; and restores that checkpoint on
reboot.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_HIBERNATION</html:code>, run the following command:
    <html:code>grep CONFIG_HIBERNATION /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R23</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Suspending to disk allows one to replace the running kernel.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_hibernation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_hibernation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_ia32_emulation" severity="medium">
            <xccdf-1.2:title>Disable IA32 emulation</xccdf-1.2:title>
            <xccdf-1.2:description>Disables support for legacy 32-bit programs under a 64-bit kernel.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_IA32_EMULATION</html:code>, run the following command:
    <html:code>grep CONFIG_IA32_EMULATION /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:warning category="general">Only disable support for 32-bit programs if you are sure you don't need any 32-bit program.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R25</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling 32-bit backwards compatibility helps reduce the attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#x86_64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_ia32_emulation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_ia32_emulation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_ipv6" severity="medium">
            <xccdf-1.2:title>Disable the IPv6 protocol</xccdf-1.2:title>
            <xccdf-1.2:description>Disable support for IP version 6 (IPv6).

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_IPV6</html:code>, run the following command:
    <html:code>grep CONFIG_IPV6 /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Any unnecessary network stacks, including IPv6, should be disabled to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_ipv6:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_ipv6_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_kexec" severity="low">
            <xccdf-1.2:title>Disable kexec system call</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>kexec</html:code> is a system call that implements the ability to shutdown your current kernel,
and to start another kernel. It is like a reboot but it is independent of the system firmware.
And like a reboot you can start any kernel with it, not just Linux.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_KEXEC</html:code>, run the following command:
    <html:code>grep CONFIG_KEXEC /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R23</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Prohibits the execution of a new kernel image after reboot.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_kexec:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_kexec_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_ptys" severity="medium">
            <xccdf-1.2:title>Disable legacy (BSD) PTY support</xccdf-1.2:title>
            <xccdf-1.2:description>Disable the Linux traditional BSD-like terminal names /dev/ptyxx for masters and /dev/ttyxx for
slaves of pseudo terminals, and use only the modern ptys (devpts) interface.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_PTYS</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_PTYS /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R23</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The legacy scheme has a number of security problems.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_legacy_ptys:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_legacy_ptys_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_emulate" severity="medium">
            <xccdf-1.2:title>Disable vsyscall emulation</xccdf-1.2:title>
            <xccdf-1.2:description>The kernel traps and emulates calls into the fixed vsyscall address mapping.
This configuration is available from kernel 5.3, but may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_VSYSCALL_EMULATE</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_VSYSCALL_EMULATE /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The mapping is non-executable, but it still contains known contents, which could be
used in certain rare security vulnerability exploits.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_legacy_vsyscall_emulate:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_legacy_vsyscall_emulate_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_none" severity="medium">
            <xccdf-1.2:title>Disable vsyscall mapping</xccdf-1.2:title>
            <xccdf-1.2:description>This config disables the vsyscall mapping at all. Attempts to use the vsyscalls will be reported to
dmesg, so that either old or malicious userspace programs can be identified.
This configuration is available from kernel 4.4.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_VSYSCALL_NONE</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_VSYSCALL_NONE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This will eliminate any risk of ASLR bypass due to the vsyscall fixed address mapping.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_legacy_vsyscall_none:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_legacy_vsyscall_none_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_legacy_vsyscall_xonly" severity="medium">
            <xccdf-1.2:title>Disable vsyscall emulate execution only</xccdf-1.2:title>
            <xccdf-1.2:description>The kernel traps and emulates calls into the fixed vsyscall address mapping and does not allow
reads.
This configuration is available from kernel 5.3.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_LEGACY_VSYSCALL_XONLY</html:code>, run the following command:
    <html:code>grep CONFIG_LEGACY_VSYSCALL_XONLY /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling this mitigates certain uses of the vsyscall area as an ASLR-bypassing buffer.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_legacy_vsyscall_xonly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_legacy_vsyscall_xonly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_modify_ldt_syscall" severity="medium">
            <xccdf-1.2:title>Disable the LDT (local descriptor table)</xccdf-1.2:title>
            <xccdf-1.2:description>Linux can allow user programs to install a per-process x86 Local Descriptor Table (LDT) using
the modify_ldt(2) system call. This is required to run 16-bit or segmented code such as DOSEMU
or some Wine programs. It is also used by some very old threading libraries.
This configuration is available from kernel 4.3, but may be available if backported
by distros.

Disable LDT if 16-bit program emulation is not necessary.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODIFY_LDT_SYSCALL</html:code>, run the following command:
    <html:code>grep CONFIG_MODIFY_LDT_SYSCALL /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R25</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling support for unnecessary code reduces attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#x86_64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_modify_ldt_syscall:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_modify_ldt_syscall_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig" severity="medium">
            <xccdf-1.2:title>Enable module signature verification</xccdf-1.2:title>
            <xccdf-1.2:description>Check modules for valid signatures upon load.
Note that this option adds the OpenSSL development packages as a kernel build dependency so
that the signing tool can use its crypto library.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Loaded modules must be signed.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_module_sig:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_module_sig_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_all" severity="medium">
            <xccdf-1.2:title>Enable automatic signing of all modules</xccdf-1.2:title>
            <xccdf-1.2:description>Sign all modules during make modules_install. Without this option, modules must be signed
manually, using the scripts/sign-file tool.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_ALL</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_ALL /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This ensures the modules are signed during install process.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_module_sig_all:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_module_sig_all_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_force" severity="medium">
            <xccdf-1.2:title>Require modules to be validly signed</xccdf-1.2:title>
            <xccdf-1.2:description>Reject unsigned modules or signed modules with an unknown key.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_FORCE</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_FORCE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Prevent loading modules that are unsigned or signed with an unknown key.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_module_sig_force:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_module_sig_force_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_hash" severity="medium">
            <xccdf-1.2:title>Specify the hash to use when signing modules</xccdf-1.2:title>
            <xccdf-1.2:description>This configures the kernel to build and sign modules using
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash" use="legacy"/> as the hash function.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_HASH</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_HASH /boot/config-*</html:code>
    
    For each kernel installed, a line with value "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash" use="legacy"/>" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Use of strong hash function is important to secure the module against counterfeit signatures.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_kernel_config_module_sig_hash:var:1" value-id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_hash"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_module_sig_hash:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_module_sig_hash_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_key" severity="medium">
            <xccdf-1.2:title>Specify module signing key to use</xccdf-1.2:title>
            <xccdf-1.2:description>Setting this option to something other than its default of <html:code>certs/signing_key.pem</html:code> will
disable the autogeneration of signing keys and allow the kernel modules to be signed with a key
of your choosing.

The string provided should identify a file containing both a private key and
its corresponding X.509 certificate in PEM form, or — on systems where the OpenSSL ENGINE_pkcs11
is functional — a PKCS#11 URI as defined by RFC7512. In the latter case, the PKCS#11 URI should
reference both a certificate and a private key.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_KEY</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_KEY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key" use="legacy"/>" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>A key and certificate is required to sign the built modules.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_kernel_config_module_sig_key:var:1" value-id="xccdf_org.ssgproject.content_value_var_kernel_config_module_sig_key"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_module_sig_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_module_sig_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_module_sig_sha512" severity="medium">
            <xccdf-1.2:title>Sign kernel modules with SHA-512</xccdf-1.2:title>
            <xccdf-1.2:description>This configures the kernel to build and sign modules using SHA512 as the hash function.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_MODULE_SIG_SHA512</html:code>, run the following command:
    <html:code>grep CONFIG_MODULE_SIG_SHA512 /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Use of strong hash function is important to secure the module against counterfeit signatures.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_module_sig_sha512:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_module_sig_sha512_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning" severity="medium">
            <xccdf-1.2:title>Enable poison of pages after freeing</xccdf-1.2:title>
            <xccdf-1.2:description>Fill the pages with poison patterns after free_pages() and verify the patterns before
alloc_pages. This does have a potential performance impact if enabled with the "page_poison=1"
kernel boot option.
This configuration is available from kernel 4.6.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_POISONING</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_POISONING /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The filling of the memory helps reduce the risk of information leaks from freed data.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_page_poisoning:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_page_poisoning_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_no_sanity" severity="medium">
            <xccdf-1.2:title>Enable poison without sanity check</xccdf-1.2:title>
            <xccdf-1.2:description>Skip the sanity checking on alloc, only fill the pages with poison on free. This reduces some
of the overhead of the poisoning feature.
This configuration is available from kernel 4.6.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_POISONING_NO_SANITY</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This configuration helps alleviates the performance impact of poisonining.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_page_poisoning_no_sanity:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_page_poisoning_no_sanity_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_poisoning_zero" severity="medium">
            <xccdf-1.2:title>Use zero for poisoning instead of debugging value</xccdf-1.2:title>
            <xccdf-1.2:description>Instead of using the existing poison value, fill the pages with zeros. This makes it harder to
detect when errors are occurring due to sanitization but the zeroing at free means that it is
no longer necessary to write zeros when GFP_ZERO is used on allocation.
This configuration is available from kernel 4.19.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_POISONING_ZERO</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_POISONING_ZERO /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This configuration helps alleviates the performance impact of poisonining.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_page_poisoning_zero:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_page_poisoning_zero_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_page_table_isolation" severity="high">
            <xccdf-1.2:title>Remove the kernel mapping in user mode</xccdf-1.2:title>
            <xccdf-1.2:description>This feature reduces the number of hardware side channels by ensuring that the majority of
kernel addresses are not mapped into userspace.
This configuration is available from kernel 4.15, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PAGE_TABLE_ISOLATION</html:code>, run the following command:
    <html:code>grep CONFIG_PAGE_TABLE_ISOLATION /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R25</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This is a countermeasure to the Meltdown attack.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#x86_64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_page_table_isolation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_page_table_isolation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_panic_on_oops" severity="medium">
            <xccdf-1.2:title>Kernel panic oops</xccdf-1.2:title>
            <xccdf-1.2:description>Enable the kernel to panic when it oopses.
This has the same effect as setting oops=panic on the kernel command line.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PANIC_ON_OOPS</html:code>, run the following command:
    <html:code>grep CONFIG_PANIC_ON_OOPS /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R19</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This feature ensures that the kernel does not do anything erroneous after an oops which
could result in data corruption or other issues.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_panic_on_oops:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_panic_on_oops_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_panic_timeout" severity="medium">
            <xccdf-1.2:title>Kernel panic timeout</xccdf-1.2:title>
            <xccdf-1.2:description>Set the timeout value (in seconds) until a reboot occurs when the kernel panics.
A timeout of 0 configures the system to wait forever. With a timeout value greater than 0,
the system will wait the specified amount of seconds before rebooting. While a timeout value
less than 0 makes the system reboot immediately.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PANIC_TIMEOUT</html:code>, run the following command:
    <html:code>grep CONFIG_PANIC_TIMEOUT /boot/config-*</html:code>
    
    For each kernel installed, a line with value "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout" use="legacy"/>" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R19</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This is required to enable protection against Spectre v2.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_kernel_config_panic_timeout:var:1" value-id="xccdf_org.ssgproject.content_value_var_kernel_config_panic_timeout"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_panic_timeout:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_panic_timeout_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_proc_kcore" severity="low">
            <xccdf-1.2:title>Disable support for /proc/kkcore</xccdf-1.2:title>
            <xccdf-1.2:description>Provides a virtual ELF core file of the live kernel.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_PROC_KCORE</html:code>, run the following command:
    <html:code>grep CONFIG_PROC_KCORE /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This feature exposes the memory to the userspace and can assist an attacker in discovering
attack vectors.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_proc_kcore:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_proc_kcore_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_randomize_base" severity="medium">
            <xccdf-1.2:title>Randomize the address of the kernel image (KASLR)</xccdf-1.2:title>
            <xccdf-1.2:description>In support of Kernel Address Space Layout Randomization (KASLR), this randomizes the physical
address at which the kernel image is decompressed and the virtual address where the kernel
image is mapped.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_RANDOMIZE_BASE</html:code>, run the following command:
    <html:code>grep CONFIG_RANDOMIZE_BASE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R25</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R27</xccdf-1.2:reference>
            <xccdf-1.2:rationale>An unpredictable kernel address makes it more difficult to succeed with exploits that rely on
knowledge of the location of kernel code internals.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_randomize_base:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_randomize_base_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_randomize_memory" severity="medium">
            <xccdf-1.2:title>Randomize the kernel memory sections</xccdf-1.2:title>
            <xccdf-1.2:description>Randomizes the base virtual address of kernel memory sections (physical memory mapping,
vmalloc &amp; vmemmap).
This configuration is available from kernel 4.8, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_RANDOMIZE_MEMORY</html:code>, run the following command:
    <html:code>grep CONFIG_RANDOMIZE_MEMORY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R25</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This security feature makes exploits relying on predictable memory locations less reliable.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#x86_64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_randomize_memory:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_randomize_memory_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_refcount_full" severity="medium">
            <xccdf-1.2:title>Perform full reference count validation</xccdf-1.2:title>
            <xccdf-1.2:description>Enabling this switches the refcounting infrastructure from a fast unchecked atomic_t
implementation to a fully state checked implementation, which can have a slight
impact in performance.
This configuration is available from kernel 4.13, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_REFCOUNT_FULL</html:code>, run the following command:
    <html:code>grep CONFIG_REFCOUNT_FULL /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Refcounting provides protections against various use-after-free conditions that can be
used in security flaw exploits.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_refcount_full:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_refcount_full_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_retpoline" severity="medium">
            <xccdf-1.2:title>Avoid speculative indirect branches in kernel</xccdf-1.2:title>
            <xccdf-1.2:description>Compile kernel with the retpoline compiler options to guard against kernel-to-user data leaks
by avoiding speculative indirect branches.
Requires a compiler with -mindirect-branch=thunk-extern support for full protection.
The kernel may run slower.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_RETPOLINE</html:code>, run the following command:
    <html:code>grep CONFIG_RETPOLINE /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This is required to enable protection against Spectre v2.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_retpoline:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_sched_stack_end_check" severity="medium">
            <xccdf-1.2:title>Detect stack corruption on calls to schedule()</xccdf-1.2:title>
            <xccdf-1.2:description>This option checks for a stack overrun on calls to schedule(). If the stack end location is
found to be overwritten always panic as the content of the corrupted region can no longer
be trusted.
This configuration is available from kernel 3.18.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SCHED_STACK_END_CHECK</html:code>, run the following command:
    <html:code>grep CONFIG_SCHED_STACK_END_CHECK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This ensures no erroneous behaviour occurs which could result in data corruption or a
sporadic crash at a later stage once the region is examined.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_sched_stack_end_check:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_sched_stack_end_check_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_seccomp" severity="medium">
            <xccdf-1.2:title>Enable seccomp to safely compute untrusted bytecode</xccdf-1.2:title>
            <xccdf-1.2:description>This kernel feature is useful for number crunching applications that may need to compute
untrusted bytecode during their execution. By using pipes or other transports made available
to the process as file descriptors supporting the read/write syscalls, it's possible to isolate
those applications in their own address space using seccomp.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECCOMP</html:code>, run the following command:
    <html:code>grep CONFIG_SECCOMP /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R20</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>seccomp</html:code> enables the ability to filter system calls made by an application, effectively
isolating the system's resources from it.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_seccomp:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_seccomp_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_seccomp_filter" severity="medium">
            <xccdf-1.2:title>Enable use of Berkeley Packet Filter with seccomp</xccdf-1.2:title>
            <xccdf-1.2:description>Enable tasks to build secure computing environments defined in terms of Berkeley Packet Filter
programs which implement task-defined system call filtering polices.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECCOMP_FILTER</html:code>, run the following command:
    <html:code>grep CONFIG_SECCOMP_FILTER /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R20</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Use of BPF filters allows for expressive filtering of system calls using a filter program
language with a long history of being exposed to userland.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_seccomp_filter:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_seccomp_filter_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security" severity="medium">
            <xccdf-1.2:title>Enable different security models</xccdf-1.2:title>
            <xccdf-1.2:description>This allows you to choose different security modules to be configured into your kernel.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R20</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This is enables kernel security primitives required by the LSM framework.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_security:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_security_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security_dmesg_restrict" severity="medium">
            <xccdf-1.2:title>Restrict unprivileged access to the kernel syslog</xccdf-1.2:title>
            <xccdf-1.2:description>Enforce restrictions on unprivileged users reading the kernel syslog via dmesg(8).

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY_DMESG_RESTRICT</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Prevents unprivileged users from retrieving kernel addresses with dmesg.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_security_dmesg_restrict:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_security_dmesg_restrict_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security_writable_hooks" severity="medium">
            <xccdf-1.2:title>Disable mutable hooks</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure kernel structures associated with LSMs are always mapped as read-only after system boot.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY_WRITABLE_HOOKS</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R20</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If CONFIG_SECURITY_WRITABLE_HOOKS is enabled, then hooks can be loaded at runtime and
being able to manipulate hooks is a way to bypass all LSMs.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_security_writable_hooks:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_security_writable_hooks_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_security_yama" severity="medium">
            <xccdf-1.2:title>Enable Yama support</xccdf-1.2:title>
            <xccdf-1.2:description>This enables support for LSM module Yama, which extends DAC support with additional system-wide
security settings beyond regular Linux discretionary access controls. The module will limit the
use of the system call <html:code>ptrace()</html:code>.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SECURITY_YAMA</html:code>, run the following command:
    <html:code>grep CONFIG_SECURITY_YAMA /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R20</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_security_yama:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_security_yama_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_hardened" severity="medium">
            <xccdf-1.2:title>Harden slab freelist metadata</xccdf-1.2:title>
            <xccdf-1.2:description>This feature protects integrity of the allocator's metadata.
This configuration is available from kernel 4.14.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLAB_FREELIST_HARDENED</html:code>, run the following command:
    <html:code>grep CONFIG_SLAB_FREELIST_HARDENED /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Many kernel heap attacks try to target slab cache metadata and other infrastructure.
This options makes minor performance sacrifices to harden the kernel slab allocator against
common freelist exploit methods.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_slab_freelist_hardened:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_slab_freelist_hardened_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slab_freelist_random" severity="medium">
            <xccdf-1.2:title>Randomize slab freelist</xccdf-1.2:title>
            <xccdf-1.2:description>Randomizes the freelist order used on creating new pages.
This configuration is available from kernel 5.9, but may be available if backported by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLAB_FREELIST_RANDOM</html:code>, run the following command:
    <html:code>grep CONFIG_SLAB_FREELIST_RANDOM /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This security feature reduces the predictability of the kernel slab allocator against heap overflows.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_slab_freelist_random:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_slab_freelist_random_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slab_merge_default" severity="medium">
            <xccdf-1.2:title>Disallow merge of slab caches</xccdf-1.2:title>
            <xccdf-1.2:description>For reduced kernel memory fragmentation, slab caches can be merged when they share the same
size and other characteristics. This carries a risk of kernel heap overflows being able to
overwrite objects from merged caches (and more easily control cache layout), which makes such
heap attacks easier to exploit by attackers.
This configuration is available from kernel 4.13.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLAB_MERGE_DEFAULT</html:code>, run the following command:
    <html:code>grep CONFIG_SLAB_MERGE_DEFAULT /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling the merge of slabs of similar sizes prevents the kernel from
merging a seemingly useless but vulnerable slab with a useful and valuable slab.
This increase the risk that a heap overflow could overwrite objects from merged caches,
with unmerged caches the heap overflow would only affect the objects in the same cache.
Overall, this reduces the kernel attack surface area by isolating slabs from each other.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_slab_merge_default:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_slab_merge_default_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_slub_debug" severity="medium">
            <xccdf-1.2:title>Enable SLUB debugging support</xccdf-1.2:title>
            <xccdf-1.2:description>SLUB has extensive debug support features and this allows the allocator validation checking to
be enabled.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SLUB_DEBUG</html:code>, run the following command:
    <html:code>grep CONFIG_SLUB_DEBUG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R17</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This activates the checking of the memory allocator structures and resets to zero the zones
allocated when they are released.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_slub_debug:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_slub_debug_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_stackprotector" severity="medium">
            <xccdf-1.2:title>Stack Protector buffer overlow detection</xccdf-1.2:title>
            <xccdf-1.2:description>This feature puts, at the beginning of functions, a canary value on the stack just before the
return address, and validates the value just before actually returning.
This configuration is available from kernel 4.18.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STACKPROTECTOR</html:code>, run the following command:
    <html:code>grep CONFIG_STACKPROTECTOR /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This halts the program when a stack overflow is detected, potentially reducing the impact of
exploits.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_stackprotector:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_stackprotector_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_stackprotector_strong" severity="medium">
            <xccdf-1.2:title>Strong Stack Protector</xccdf-1.2:title>
            <xccdf-1.2:description>This features adds canary logic protection to more kinds of vulnerable functions than
CONFIG_STACKPROTECTOR, but not to all functions so that performance is not severily impacted.
This configuration is available from kernel 4.18.
This config requires gcc version 4.9 or above, or a distribution gcc with the feature
backported ("-fstack-protector-strong").

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STACKPROTECTOR_STRONG</html:code>, run the following command:
    <html:code>grep CONFIG_STACKPROTECTOR_STRONG /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This provides a mechanism that protects more vulnerable functions than CONFIG_STACKPROTECTOR,
balancing between security and performance.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_stackprotector_strong:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_stackprotector_strong_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_strict_kernel_rwx" severity="medium">
            <xccdf-1.2:title>Make the kernel text and rodata read-only</xccdf-1.2:title>
            <xccdf-1.2:description>When set, kernel text and rodata memory will be made read-only, and non-text memory will be made non-executable.
This configuration is available from kernel 4.11.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STRICT_KERNEL_RWX</html:code>, run the following command:
    <html:code>grep CONFIG_STRICT_KERNEL_RWX /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This provides protection against certain security exploits (e.g. executing the heap or modifying text)</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_strict_kernel_rwx:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_strict_kernel_rwx_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_strict_module_rwx" severity="medium">
            <xccdf-1.2:title>Make the module text and rodata read-only</xccdf-1.2:title>
            <xccdf-1.2:description>When set, module text and rodata memory will be made read-only, and non-text memory will be made non-executable.
This configuration is available from kernel 4.11.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_STRICT_MODULE_RWX</html:code>, run the following command:
    <html:code>grep CONFIG_STRICT_MODULE_RWX /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R18</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This provides protection against certain security exploits (e.g. executing the heap or modifying text)</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_strict_module_rwx:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_strict_module_rwx_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_syn_cookies" severity="medium">
            <xccdf-1.2:title>Enable TCP/IP syncookie support</xccdf-1.2:title>
            <xccdf-1.2:description>Normal TCP/IP networking is open to an attack known as SYN flooding.
It is denial-of-service attack that prevents legitimate remote users from being able to connect
to your computer during an ongoing attack.

When enabled the TCP/IP stack will use a cryptographic challenge protocol known as SYN cookies
to enable legitimate users to continue to connect, even when your machine is under attack.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_SYN_COOKIES</html:code>, run the following command:
    <html:code>grep CONFIG_SYN_COOKIES /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R22</xccdf-1.2:reference>
            <xccdf-1.2:rationale>SYN cookies provide protection against SYN flooding attacks.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_syn_cookies:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_syn_cookies_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_unmap_kernel_at_el0" severity="medium">
            <xccdf-1.2:title>Unmap kernel when running in userspace (aka KAISER)</xccdf-1.2:title>
            <xccdf-1.2:description>Speculation attacks against some high-performance processors can be used to bypass MMU
permission checks and leak kernel data to userspace. This can be defended against by unmapping
the kernel when running in userspace, mapping it back in on exception entry via a trampoline
page in the vector table.
This configuration is available from kernel 4.16, but may be available if backported
by distros.
The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_UNMAP_KERNEL_AT_EL0</html:code>, run the following command:
    <html:code>grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R27</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This is a countermeasure to the Meltdown attack.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#aarch64_arch"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_unmap_kernel_at_el0:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_vmap_stack" severity="medium">
            <xccdf-1.2:title>User a virtually-mapped stack</xccdf-1.2:title>
            <xccdf-1.2:description>Enable this to use virtually-mapped kernel stacks with guard pages.
This configuration is available from kernel 4.9.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_VMAP_STACK</html:code>, run the following command:
    <html:code>grep CONFIG_VMAP_STACK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This causes kernel stack overflows to be caught immediately rather than causing difficult-to-diagnose corruption.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_vmap_stack:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_vmap_stack_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_x86_vsyscall_emulation" severity="low">
            <xccdf-1.2:title>Disable x86 vsyscall emulation</xccdf-1.2:title>
            <xccdf-1.2:description>Disabling it is roughly equivalent to booting with vsyscall=none, except that it will also
disable the helpful warning if a program tries to use a vsyscall. With this option set to N,
offending programs will just segfault, citing addresses of the form 0xffffffffff600?00.
This configuration is available from kernel 3.19.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_X86_VSYSCALL_EMULATION</html:code>, run the following command:
    <html:code>grep CONFIG_X86_VSYSCALL_EMULATION /boot/config-*</html:code>
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R15</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The vsyscall table is no longer required and is a potential source of ROP gadgets.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_x86_vsyscall_emulation:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gcc_plugin">
            <xccdf-1.2:title>Kernel GCC plugin configuration</xccdf-1.2:title>
            <xccdf-1.2:description>Contains rules that check the configuration of GCC plugins used by the compiler</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_latent_entropy" severity="medium">
              <xccdf-1.2:title>Generate some entropy during boot and runtime</xccdf-1.2:title>
              <xccdf-1.2:description>Instrument some kernel code to extract some entropy from both original and artificially created
program state. This will help especially embedded systems where there is little 'natural' source
of entropy normally.

This configuration is available from kernel 4.9, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_LATENT_ENTROPY</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_LATENT_ENTROPY /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">Note that entropy extracted this way is not cryptographically secure!</xccdf-1.2:warning>
              <xccdf-1.2:warning category="performance">There is a performance cost during the boot process (about 0.5%) and fork and irq processing.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R21</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This helps generate entropy during startup and is particularly relevant for devices with
inappropriate entropy sources.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_latent_entropy:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_randstruct" severity="medium">
              <xccdf-1.2:title>Randomize layout of sensitive kernel structures</xccdf-1.2:title>
              <xccdf-1.2:description>Randomize at compile-time the layouts of structures that are entirely function pointers
(and have not been manually annotated with __no_randomize_layout), or structures that have
been explicitly marked with __randomize_layout.
This configuration is available from kernel 4.13, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_RANDSTRUCT</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_RANDSTRUCT /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R21</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Randomizing the layout of kernel data structures make it more difficult for an attacker to
know the location of sensitive data.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_randstruct:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_randstruct_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_stackleak" severity="medium">
              <xccdf-1.2:title>Poison kernel stack before returning from syscalls</xccdf-1.2:title>
              <xccdf-1.2:description>This option makes the kernel erase the kernel stack before returning from system calls.
This has the effect of leaving the stack initialized to the poison value, which both reduces
the lifetime of any sensitive stack contents and reduces potential for uninitialized stack
variable exploits or information exposures (it does not cover functions reaching the same
stack depth as prior functions during the same syscall).

This configuration is available from kernel 4.20, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_STACKLEAK</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_STACKLEAK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="performance">The performance impact on a single CPU system kernel is of 1% slowdown.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R21</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This blocks most uninitialized stack variable attacks, with the performance impact being
driven by the depth of the stack usage, rather than the function calling complexity.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_stackleak:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_stackleak_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_structleak" severity="medium">
              <xccdf-1.2:title>Force initialization of variables containing userspace addresses</xccdf-1.2:title>
              <xccdf-1.2:description>While the kernel is built with warnings enabled for any missed stack variable initializations,
this warning is silenced for anything passed by reference to another function, under the
occasionally misguided assumption that the function will do the initialization. As this
regularly leads to exploitable flaws, this plugin is available to identify and zero-initialize
such variables, depending on the chosen level of coverage.
This configuration is available from kernel 4.11, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_STRUCTLEAK</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_STRUCTLEAK /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R21</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Initializing structures from userspace can prevent some classes of information exposure.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_structleak:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_structleak_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_config_gcc_plugin_structleak_byref_all" severity="medium">
              <xccdf-1.2:title>zero-init everything passed by reference</xccdf-1.2:title>
              <xccdf-1.2:description>Zero-initialize any stack variables that may be passed by reference and had not already been explicitly initialized.
This configuration is available from kernel 4.14, but may be available if backported
by distros.

The configuration that was used to build kernel is available at <html:code>/boot/config-*</html:code>.
    To check the configuration value for <html:code>CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL</html:code>, run the following command:
    <html:code>grep CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL /boot/config-*</html:code>
    
    For each kernel installed, a line with value "y" should be returned.
    </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no remediation for this besides re-compiling the kernel with the appropriate value for the config.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R21</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This eliminates all classes of uninitialized stack variable exploits and information exposures.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_config_gcc_plugin_structleak_byref_all:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_logging">
          <xccdf-1.2:title>Configure Syslog</xccdf-1.2:title>
          <xccdf-1.2:description>The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
<html:br/>
      <html:br/>
In Oracle Linux 9, rsyslog has replaced ksyslogd as the
syslog daemon of choice, and it includes some additional security features
such as reliable, connection-oriented (i.e. TCP) transmission of logs, the
option to log to database formats, and the encryption of log data en route to
a central logging server.
This section discusses how to configure rsyslog for
best effect, and how to use tools provided with the system to maintain and
monitor logs.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" severity="medium">
            <xccdf-1.2:title>Ensure rsyslog-gnutls is installed</xccdf-1.2:title>
            <xccdf-1.2:description>TLS protocol support for rsyslog is installed.

The <html:code>rsyslog-gnutls</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install rsyslog-gnutls</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000355</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271510r1091242_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The rsyslog-gnutls package provides Transport Layer Security (TLS) support
for the rsyslog daemon, which enables secure remote logging.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "rsyslog-gnutls" ; then
    yum install -y "rsyslog-gnutls"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000355
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsyslog-gnutls_installed

- name: Ensure rsyslog-gnutls is installed
  package:
    name: rsyslog-gnutls
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000355
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsyslog-gnutls_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rsyslog-gnutls

class install_rsyslog-gnutls {
  package { 'rsyslog-gnutls':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rsyslog-gnutls_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rsyslog-gnutls
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rsyslog-gnutls_installed">
[[packages]]
name = "rsyslog-gnutls"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_rsyslog-gnutls_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" severity="medium">
            <xccdf-1.2:title>Ensure rsyslog is Installed</xccdf-1.2:title>
            <xccdf-1.2:description>Rsyslog is installed by default. The <html:code>rsyslog</html:code> package can be installed with the following command: <html:pre> $ sudo yum install rsyslog</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000154</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000350</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271508r1091236_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The rsyslog package provides the rsyslog daemon, which provides
system logging services.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "rsyslog" ; then
    yum install -y "rsyslog"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000350
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsyslog_installed

- name: Ensure rsyslog is installed
  package:
    name: rsyslog
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000350
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsyslog_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_rsyslog

class install_rsyslog {
  package { 'rsyslog':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rsyslog_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=rsyslog
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_rsyslog_installed">
[[packages]]
name = "rsyslog"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_rsyslog_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" severity="medium">
            <xccdf-1.2:title>Enable rsyslog Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>rsyslog</html:code> service provides syslog-style logging by default on Oracle Linux 9.

The <html:code>rsyslog</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable rsyslog.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000351</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271509r1091239_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>rsyslog</html:code> service must be running in order to provide
logging services, which are essential to system administration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rsyslog.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'rsyslog.service'
fi
"$SYSTEMCTL_EXEC" enable 'rsyslog.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000351
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyslog_enabled

- name: Enable rsyslog Service - Enable service rsyslog
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable rsyslog Service - Enable Service rsyslog
    ansible.builtin.systemd:
      name: rsyslog
      enabled: true
      state: started
      masked: false
    when:
    - '"rsyslog" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000351
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyslog_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rsyslog_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_rsyslog

class enable_rsyslog {
  service {'rsyslog':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rsyslog_enabled">
[customizations.services]
enabled = ["rsyslog"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_rsyslog_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration">
            <xccdf-1.2:title>Ensure Proper Configuration of Log Files</xccdf-1.2:title>
            <xccdf-1.2:description>The file <html:code>/etc/rsyslog.conf</html:code> controls where log message are written.
These are controlled by lines called <html:i>rules</html:i>, which consist of a
<html:i>selector</html:i> and an <html:i>action</html:i>.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Oracle Linux 9 are:
<html:pre>*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log</html:pre>
See the man page <html:code>rsyslog.conf(5)</html:code> for more information.
<html:i>Note that the <html:code>rsyslog</html:code> daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file <html:code>/etc/rsyslog.conf</html:code> and add or edit the following line:</html:i>
       <html:pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:platform idref="#package_rsyslog"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" severity="medium">
              <xccdf-1.2:title>Ensure cron Is Logging To Rsyslog</xccdf-1.2:title>
              <xccdf-1.2:description>Cron logging must be implemented to spot intrusions or trace
cron job status. If <html:code>cron</html:code> is not logging to <html:code>rsyslog</html:code>, it
can be implemented by adding the following to the <html:i>RULES</html:i> section of
<html:code>/etc/rsyslog.conf</html:code>:
If the legacy syntax is used:
<html:pre>cron.*                                                  /var/log/cron</html:pre>
If the modern syntax (RainerScript) is used:
<html:pre>cron.* action(type="omfile" file="/var/log/cron")</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005010</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271853r1092271_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Cron logging can be used to trace the successful or unsuccessful execution
of cron jobs. It can also be used to spot intrusions into the use of the cron
facility by unauthorized and malicious users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_cron_logging"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

if ! grep -Pzo '(?m)^\s*(cron|\*)\.\*\s*(/var/log/(cron|messages)|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/(cron|messages)"\s*\))\s*$' /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then

	mkdir -p /etc/rsyslog.d
	echo "cron.*	/var/log/cron" &gt;&gt; /etc/rsyslog.d/cron.conf
fi

if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    systemctl restart rsyslog.service
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_cron_logging" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005010
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_cron_logging

- name: Ensure cron Is Logging To Rsyslog - Search if cron configuration exists
  ansible.builtin.command: grep -Pzo '(?m)^\s*(cron|\*)\.\*\s*(/var/log/(cron|messages)|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/(cron|messages)"\s*\))\s*$'
    /etc/rsyslog.conf /etc/rsyslog.d/*.conf
  register: cron_log_config_exists
  failed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005010
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_cron_logging

- name: Ensure cron Is Logging To Rsyslog - Ensure the /etc/rsyslog.d directory exists
  ansible.builtin.file:
    path: /etc/rsyslog.d
    state: directory
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005010
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_cron_logging

- name: Ensure cron Is Logging To Rsyslog - Add cron log configuration line
  ansible.builtin.lineinfile:
    path: /etc/rsyslog.d/cron.conf
    line: cron.*  /var/log/cron
    create: true
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - cron_log_config_exists.stdout_lines | length == 0
  tags:
  - DISA-STIG-OL09-00-005010
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_cron_logging

- name: Ensure cron Is Logging To Rsyslog - Restart the rsyslog service now
  ansible.builtin.service:
    name: rsyslog
    state: restarted
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005010
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_cron_logging
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_cron_logging:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" severity="medium">
              <xccdf-1.2:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</xccdf-1.2:title>
              <xccdf-1.2:description>Rsyslogd is a system utility providing support for message logging. Support
for both internet and UNIX domain sockets enables this utility to support both local
and remote logging.  Couple this utility with <html:code>gnutls</html:code> (which is a secure communications
library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
encrypt and off-load auditing.

When using <html:code>rsyslogd</html:code> to off-load logs the remote system must be authenticated.

Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
<html:pre>$ActionSendStreamDriverAuthMode x509/name</html:pre>
Alternatively, use the RainerScript syntax:
<html:pre>action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271854r1092274_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit records generated by Rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Audit records should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

sed -i '/^.*\$ActionSendStreamDriverAuthMode.*/d' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2&gt; /dev/null

if [ -e "/etc/rsyslog.d/stream_driver_auth.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*\$ActionSendStreamDriverAuthMode /Id" "/etc/rsyslog.d/stream_driver_auth.conf"
else
    touch "/etc/rsyslog.d/stream_driver_auth.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/rsyslog.d/stream_driver_auth.conf"

cp "/etc/rsyslog.d/stream_driver_auth.conf" "/etc/rsyslog.d/stream_driver_auth.conf.bak"
# Insert at the end of the file
printf '%s\n' "\$ActionSendStreamDriverAuthMode x509/name" &gt;&gt; "/etc/rsyslog.d/stream_driver_auth.conf"
# Clean up after ourselves.
rm "/etc/rsyslog.d/stream_driver_auth.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005015
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

- name: Ensure Rsyslog Authenticates Off-Loaded Audit Records
  block:

  - name: Deduplicate values from /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: false
      regexp: (?i)^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
      state: absent

  - name: Check if /etc/rsyslog.d exists
    stat:
      path: /etc/rsyslog.d
    register: _etc_rsyslog_d_exists

  - name: Check if the parameter $ActionSendStreamDriverAuthMode is present in /etc/rsyslog.d
    find:
      paths: /etc/rsyslog.d
      recurse: 'yes'
      follow: 'no'
      contains: ^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
    register: _etc_rsyslog_d_has_parameter
    when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/rsyslog.d
    lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
      state: absent
    with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
    when: _etc_rsyslog_d_has_parameter.matched

  - name: Insert correct line to /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: true
      regexp: (?i)^\s*{{ "$ActionSendStreamDriverAuthMode"| regex_escape }}\s
      line: $ActionSendStreamDriverAuthMode x509/name
      state: present
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005015
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" severity="medium">
              <xccdf-1.2:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</xccdf-1.2:title>
              <xccdf-1.2:description>Rsyslogd is a system utility providing support for message logging. Support
for both internet and UNIX domain sockets enables this utility to support both local
and remote logging.  Couple this utility with <html:code>gnutls</html:code> (which is a secure communications
library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
encrypt and off-load auditing.

When using <html:code>rsyslogd</html:code> to off-load logs off a encrpytion system must be used.

Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
<html:pre>$ActionSendStreamDriverMode 1</html:pre>

Alternatively, use the RainerScript syntax:
<html:pre>action(type="omfwd" ... StreamDriverMode="1")</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271855r1092277_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit records generated by Rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Audit records should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_encrypt_offload_actionsendstreamdrivermode"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

if [ -e "/etc/rsyslog.d/encrypt.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*\$ActionSendStreamDriverMode /Id" "/etc/rsyslog.d/encrypt.conf"
else
    touch "/etc/rsyslog.d/encrypt.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/rsyslog.d/encrypt.conf"

cp "/etc/rsyslog.d/encrypt.conf" "/etc/rsyslog.d/encrypt.conf.bak"
# Insert at the end of the file
printf '%s\n' "\$ActionSendStreamDriverMode 1" &gt;&gt; "/etc/rsyslog.d/encrypt.conf"
# Clean up after ourselves.
rm "/etc/rsyslog.d/encrypt.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_encrypt_offload_actionsendstreamdrivermode" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005020
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_actionsendstreamdrivermode

- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
  block:

  - name: Deduplicate values from /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: false
      regexp: '(?i)^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
      state: absent

  - name: Check if /etc/rsyslog.d exists
    stat:
      path: /etc/rsyslog.d
    register: _etc_rsyslog_d_exists

  - name: Check if the parameter $ActionSendStreamDriverMode is present in /etc/rsyslog.d
    find:
      paths: /etc/rsyslog.d
      recurse: 'yes'
      follow: 'no'
      contains: '^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
    register: _etc_rsyslog_d_has_parameter
    when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/rsyslog.d
    lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: '(?i)^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
      state: absent
    with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
    when: _etc_rsyslog_d_has_parameter.matched

  - name: Insert correct line to /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: true
      regexp: '(?i)^\s*{{ "$ActionSendStreamDriverMode"| regex_escape }} '
      line: $ActionSendStreamDriverMode 1
      state: present
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005020
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_actionsendstreamdrivermode
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" severity="medium">
              <xccdf-1.2:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</xccdf-1.2:title>
              <xccdf-1.2:description>Rsyslogd is a system utility providing support for message logging. Support
for both internet and UNIX domain sockets enables this utility to support both local
and remote logging.  Couple this utility with <html:code>gnutls</html:code> (which is a secure communications
library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
encrypt and off-load auditing.

When using <html:code>rsyslogd</html:code> to off-load logs off an encryption system must be used.

Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
<html:pre>$DefaultNetstreamDriver gtls</html:pre>

Alternatively, use the RainerScript syntax:
<html:pre>global(DefaultNetstreamDriver="gtls")</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005025</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271856r1092280_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The audit records generated by Rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Audit records should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_encrypt_offload_defaultnetstreamdriver"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

if [ -e "/etc/rsyslog.d/encrypt.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*\$DefaultNetstreamDriver /Id" "/etc/rsyslog.d/encrypt.conf"
else
    touch "/etc/rsyslog.d/encrypt.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/rsyslog.d/encrypt.conf"

cp "/etc/rsyslog.d/encrypt.conf" "/etc/rsyslog.d/encrypt.conf.bak"
# Insert at the end of the file
printf '%s\n' "\$DefaultNetstreamDriver gtls" &gt;&gt; "/etc/rsyslog.d/encrypt.conf"
# Clean up after ourselves.
rm "/etc/rsyslog.d/encrypt.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_encrypt_offload_defaultnetstreamdriver" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005025
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_defaultnetstreamdriver

- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
  block:

  - name: Deduplicate values from /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: false
      regexp: '(?i)^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      state: absent

  - name: Check if /etc/rsyslog.d exists
    stat:
      path: /etc/rsyslog.d
    register: _etc_rsyslog_d_exists

  - name: Check if the parameter $DefaultNetstreamDriver is present in /etc/rsyslog.d
    find:
      paths: /etc/rsyslog.d
      recurse: 'yes'
      follow: 'no'
      contains: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
    register: _etc_rsyslog_d_has_parameter
    when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/rsyslog.d
    lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: '(?i)^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      state: absent
    with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
    when: _etc_rsyslog_d_has_parameter.matched

  - name: Insert correct line to /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: true
      regexp: '(?i)^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      line: $DefaultNetstreamDriver gtls
      state: present
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005025
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_defaultnetstreamdriver
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" severity="medium">
              <xccdf-1.2:title>Ensure Log Files Are Owned By Appropriate Group</xccdf-1.2:title>
              <xccdf-1.2:description>The group-owner of all log files written by
<html:code>rsyslog</html:code> should be <html:code>root</html:code>.
These log files are determined by the second part of each Rule line in
<html:code>/etc/rsyslog.conf</html:code> and typically all appear in <html:code>/var/log</html:code>.
For each log file <html:i>LOGFILE</html:i> referenced in <html:code>/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's group owner:
<html:pre>$ ls -l <html:i>LOGFILE</html:i>
        </html:pre>
If the owner is not <html:code>root</html:code>,
run the following command to
correct this:
<html:pre>$ sudo chgrp root <html:i>LOGFILE</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_files_groupownership"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t OLD_INC &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
readarray -t NEW_INC &lt; &lt;(sed -n '/^\s*include(/,/)/Ip' /etc/rsyslog.conf | sed -n 's@.*file\s*=\s*"\([/[:alnum:][:punct:]]*\)".*@\1@Ip')
readarray -t RSYSLOG_INCLUDE &lt; &lt;(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Array to hold all rsyslog config entries
RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_CONFIG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
	# If directory, rsyslog will search for config files in recursively.
	# However, files in hidden sub-directories or hidden files will be ignored.
	if [ -d "${ENTRY}" ]
	then
		readarray -t FINDOUT &lt; &lt;(find "${ENTRY}" -not -path '*/.*' -type f)
		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
	elif [ -f "${ENTRY}" ]
	then
		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
	else
		echo "Invalid include object: ${ENTRY}"
	fi
done

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the
	# following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(awk '{if(NF&gt;=2&amp;&amp;($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split
		# the particular matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

# Check for RainerScript action log format which might be also multiline so grep regex is a bit
# curly:
# extract possibly multiline action omfile expressions
# extract File="logfile" expression
# match only "logfile" expression
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	ACTION_OMFILE_LINES=$(grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
done

# Ensure the correct attribute if file exists
FILE_CMD="chgrp"
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi
	$FILE_CMD "root" "$LOG_FILE_PATH"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_files_groupownership" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Set rsyslog logfile configuration
    facts
  ansible.builtin.set_fact:
    rsyslog_etc_config: /etc/rsyslog.conf
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Get IncludeConfig directive
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Get include files directives
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Aggregate rsyslog includes
  ansible.builtin.set_fact:
    include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
      }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - List all config files
  ansible.builtin.find:
    paths: '{{ item | dirname }}'
    patterns: '{{ item | basename }}'
    hidden: false
    follow: true
  loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - include_config_output is defined
  register: rsyslog_config_files
  failed_when: false
  changed_when: false
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Extract log files old format
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_old
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Extract log files new format
  ansible.builtin.shell: |
    set -o pipefail
    grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -aoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\""|| true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_new
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Sum all log files found
  ansible.builtin.set_fact:
    log_files: '{{ log_files_new.results | map(attribute=''stdout_lines'') | list
      | flatten | unique + log_files_old.results | map(attribute=''stdout_lines'')
      | list | flatten | unique }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group -Setup log files attribute
  ansible.builtin.file:
    path: '{{ item }}'
    group: root
    state: file
  loop: '{{ log_files | list | flatten | unique }}'
  failed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_files_groupownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" severity="medium">
              <xccdf-1.2:title>Ensure Log Files Are Owned By Appropriate User</xccdf-1.2:title>
              <xccdf-1.2:description>The owner of all log files written by
<html:code>rsyslog</html:code> should be

<html:code>root</html:code>.

These log files are determined by the second part of each Rule line in
<html:code>/etc/rsyslog.conf</html:code> and typically all appear in <html:code>/var/log</html:code>.
For each log file <html:i>LOGFILE</html:i> referenced in <html:code>/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's owner:
<html:pre>$ ls -l <html:i>LOGFILE</html:i>
        </html:pre>
If the owner is not

<html:code>root</html:code>,

run the following command to
correct this:

<html:pre>$ sudo chown root <html:i>LOGFILE</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_files_ownership"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t OLD_INC &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
readarray -t NEW_INC &lt; &lt;(sed -n '/^\s*include(/,/)/Ip' /etc/rsyslog.conf | sed -n 's@.*file\s*=\s*"\([/[:alnum:][:punct:]]*\)".*@\1@Ip')
readarray -t RSYSLOG_INCLUDE &lt; &lt;(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Array to hold all rsyslog config entries
RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_CONFIG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
	# If directory, rsyslog will search for config files in recursively.
	# However, files in hidden sub-directories or hidden files will be ignored.
	if [ -d "${ENTRY}" ]
	then
		readarray -t FINDOUT &lt; &lt;(find "${ENTRY}" -not -path '*/.*' -type f)
		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
	elif [ -f "${ENTRY}" ]
	then
		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
	else
		echo "Invalid include object: ${ENTRY}"
	fi
done

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the
	# following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(awk '{if(NF&gt;=2&amp;&amp;($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split
		# the particular matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

# Check for RainerScript action log format which might be also multiline so grep regex is a bit
# curly:
# extract possibly multiline action omfile expressions
# extract File="logfile" expression
# match only "logfile" expression
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	ACTION_OMFILE_LINES=$(grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
done

# Ensure the correct attribute if file exists
FILE_CMD="chown"
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi
	$FILE_CMD "root" "$LOG_FILE_PATH"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_files_ownership" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Set rsyslog logfile configuration
    facts
  ansible.builtin.set_fact:
    rsyslog_etc_config: /etc/rsyslog.conf
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Get IncludeConfig directive
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Get include files directives
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Aggregate rsyslog includes
  ansible.builtin.set_fact:
    include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
      }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - List all config files
  ansible.builtin.find:
    paths: '{{ item | dirname }}'
    patterns: '{{ item | basename }}'
    hidden: false
    follow: true
  loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - include_config_output is defined
  register: rsyslog_config_files
  failed_when: false
  changed_when: false
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Extract log files old format
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_old
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Extract log files new format
  ansible.builtin.shell: |
    set -o pipefail
    grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -aoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\""|| true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_new
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Sum all log files found
  ansible.builtin.set_fact:
    log_files: '{{ log_files_new.results | map(attribute=''stdout_lines'') | list
      | flatten | unique + log_files_old.results | map(attribute=''stdout_lines'')
      | list | flatten | unique }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User -Setup log files attribute
  ansible.builtin.file:
    path: '{{ item }}'
    owner: root
    state: file
  loop: '{{ log_files | list | flatten | unique }}'
  failed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_files_ownership:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" severity="medium">
              <xccdf-1.2:title>Ensure System Log Files Have Correct Permissions</xccdf-1.2:title>
              <xccdf-1.2:description>The file permissions for all log files written by <html:code>rsyslog</html:code> should
be set to 640, or more restrictive. These log files are determined by the
second part of each Rule line in <html:code>/etc/rsyslog.conf</html:code> and typically
all appear in <html:code>/var/log</html:code>. For each log file <html:i>LOGFILE</html:i>
referenced in <html:code>/etc/rsyslog.conf</html:code>, run the following command to
inspect the file's permissions:
<html:pre>$ ls -l <html:i>LOGFILE</html:i>
        </html:pre>
If the permissions are not 640 or more restrictive, run the following
command to correct this:
<html:pre>$ sudo chmod 640 <html:i>LOGFILE</html:i>
        </html:pre>"</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Log files can contain valuable information regarding system
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_files_permissions"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t OLD_INC &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
readarray -t NEW_INC &lt; &lt;(sed -n '/^\s*include(/,/)/Ip' /etc/rsyslog.conf | sed -n 's@.*file\s*=\s*"\([/[:alnum:][:punct:]]*\)".*@\1@Ip')
readarray -t RSYSLOG_INCLUDE &lt; &lt;(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Array to hold all rsyslog config entries
RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_CONFIG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
	# If directory, rsyslog will search for config files in recursively.
	# However, files in hidden sub-directories or hidden files will be ignored.
	if [ -d "${ENTRY}" ]
	then
		readarray -t FINDOUT &lt; &lt;(find "${ENTRY}" -not -path '*/.*' -type f)
		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
	elif [ -f "${ENTRY}" ]
	then
		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
	else
		echo "Invalid include object: ${ENTRY}"
	fi
done

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the
	# following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(awk '{if(NF&gt;=2&amp;&amp;($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split
		# the particular matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

# Check for RainerScript action log format which might be also multiline so grep regex is a bit
# curly:
# extract possibly multiline action omfile expressions
# extract File="logfile" expression
# match only "logfile" expression
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	ACTION_OMFILE_LINES=$(grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
done

# Ensure the correct attribute if file exists
FILE_CMD="chmod"
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi
	$FILE_CMD "0640" "$LOG_FILE_PATH"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_files_permissions" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Set rsyslog logfile configuration
    facts
  ansible.builtin.set_fact:
    rsyslog_etc_config: /etc/rsyslog.conf
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Get IncludeConfig directive
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Get include files directives
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Aggregate rsyslog includes
  ansible.builtin.set_fact:
    include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
      }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - List all config files
  ansible.builtin.find:
    paths: '{{ item | dirname }}'
    patterns: '{{ item | basename }}'
    hidden: false
    follow: true
  loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - include_config_output is defined
  register: rsyslog_config_files
  failed_when: false
  changed_when: false
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Extract log files old format
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_old
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Extract log files new format
  ansible.builtin.shell: |
    set -o pipefail
    grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -aoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\""|| true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_new
  changed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Sum all log files found
  ansible.builtin.set_fact:
    log_files: '{{ log_files_new.results | map(attribute=''stdout_lines'') | list
      | flatten | unique + log_files_old.results | map(attribute=''stdout_lines'')
      | list | flatten | unique }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions -Setup log files attribute
  ansible.builtin.file:
    path: '{{ item }}'
    mode: '0640'
    state: file
  loop: '{{ log_files | list | flatten | unique }}'
  failed_when: false
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_files_permissions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring" severity="medium">
              <xccdf-1.2:title>Ensure remote access methods are monitored in Rsyslog</xccdf-1.2:title>
              <xccdf-1.2:description>Logging of remote access methods must be implemented to help identify cyber
attacks and ensure ongoing compliance with remote access policies are being
audited and upheld. An examples of a remote access method is the use of the
Remote Desktop Protocol (RDP) from an external, non-organization controlled
network. The <html:code>/etc/rsyslog.conf</html:code> or
<html:code>/etc/rsyslog.d/*.conf</html:code> file should contain a match for the following
selectors: <html:code>auth.*</html:code>, <html:code>authpriv.*</html:code>, and <html:code>daemon.*</html:code>. If
not, use the following as an example configuration:
<html:code>
    auth.*;authpriv.*                              /var/log/secure
    daemon.*                                       /var/log/messages
</html:code>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000032-GPOS-00013</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005000</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271851r1092265_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Logging remote access methods can be used to trace the decrease the risks
associated with remote user access management. It can also be used to spot
cyber attacks and ensure ongoing compliance with organizational policies
surrounding the use of remote access methods.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_remote_access_monitoring"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q rsyslog; then

declare -A REMOTE_METHODS=( ['auth.*']='^[^#]*auth\.\*.*$' ['authpriv.*']='^[^#]*authpriv\.\*.*$' ['daemon.*']='^[^#]*daemon\.\*.*$' )
declare -A LOCATIONS=( ['auth.*']='/var/log/secure' ['authpriv.*']='/var/log/secure' ['daemon.*']='/var/log/messages' )

if [[ ! -f /etc/rsyslog.conf ]]; then
	# Something is not right, create the file
	touch /etc/rsyslog.conf
fi


# Loop through the remote methods associative array
for K in "${!REMOTE_METHODS[@]}"
do
	# Check to see if selector/value exists
	if ! grep -rq "${REMOTE_METHODS[$K]}" /etc/rsyslog.*; then
        APPEND_LINE=$(sed -rn "/^\S+\s+\${LOCATIONS[$K]}$/p" /etc/rsyslog.conf)
		# Make sure we have a line to insert after, otherwise append to end
		if [[ ! -z ${APPEND_LINE} ]]; then
			# Add selector to file
			sed -r -i "0,/^(\S+\s+\/var\/log\/secure$)/s//\1\n${K} \/var\/log\/secure/" /etc/rsyslog.conf
		else
			echo "${K} ${LOCATIONS[$K]}" &gt;&gt; /etc/rsyslog.conf
		fi
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_remote_access_monitoring" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Set facts'
  set_fact:
    conf_files:
    - /etc/rsyslog.conf
    remote_methods:
    - selector: auth.*
      regexp: ^.*auth\.\*.*$
      location: /var/log/secure
    - selector: authpriv.*
      regexp: ^.*authpriv\.\*.*$
      location: /var/log/secure
    - selector: daemon.*
      regexp: ^.*daemon\.\*.*$
      location: /var/log/messages
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Ensure rsyslog.conf
    exists'
  file:
    path: '{{ conf_files.0 }}'
    state: touch
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Gather conf.d files'
  find:
    patterns:
    - '*.conf'
    paths:
    - /etc/rsyslog.d
  register: rsyslogd
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Set conf file(s)'
  set_fact:
    conf_files: '{{ conf_files + [item.path] }}'
  loop: '{{ rsyslogd.files }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslogd.matched &gt; 0
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Check for existing
    values'
  lineinfile:
    path: '{{ item.1 }}'
    regexp: '{{ item.0.regexp }}'
    state: absent
  check_mode: true
  changed_when: false
  register: remote_method_values
  loop: '{{ remote_methods|product(conf_files)|list }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring

- name: 'Ensure remote access methods are monitored in Rsyslog: Configure'
  lineinfile:
    path: /etc/rsyslog.conf
    line: '{{ item.item.0.selector }} {{ item.item.0.location }}'
    insertafter: ^.*\/var\/log\/secure.*$
    create: true
  loop: '{{ remote_method_values.results }}'
  when:
  - '"rsyslog" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - item.found == 0
  tags:
  - DISA-STIG-OL09-00-005000
  - NIST-800-53-AC-17(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_access_monitoring
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_remote_access_monitoring:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_remote_access_monitoring_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_journald">
            <xccdf-1.2:title>systemd-journald</xccdf-1.2:title>
            <xccdf-1.2:description>systemd-journald is a system service that collects and stores
logging data. It creates and maintains structured, indexed
journals based on logging information that is received from a
variety of sources.

For more information on <html:code>systemd-journald </html:code> and additional <html:code>systemd-journald</html:code> configuration options, see
<html:b><html:a href="https://systemd.io/">https://systemd.io/</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" severity="medium">
              <xccdf-1.2:title>Enable systemd-journald Service</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>systemd-journald</html:code> service is an essential component of
systemd.

The <html:code>systemd-journald</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable systemd-journald.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001665</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-24</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000269-GPOS-00103</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002400</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271739r1091929_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>In the event of a system failure, Oracle Linux 9 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_systemd-journald_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'systemd-journald.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'systemd-journald.service'
fi
"$SYSTEMCTL_EXEC" enable 'systemd-journald.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_systemd-journald_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002400
  - NIST-800-53-SC-24
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-journald_enabled

- name: Enable systemd-journald Service - Enable service systemd-journald
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable systemd-journald Service - Enable Service systemd-journald
    ansible.builtin.systemd:
      name: systemd-journald
      enabled: true
      state: started
      masked: false
    when:
    - '"systemd" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002400
  - NIST-800-53-SC-24
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-journald_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_systemd-journald_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_systemd-journald

class enable_systemd-journald {
  service {'systemd-journald':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_systemd-journald_enabled">
[customizations.services]
enabled = ["systemd-journald"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_systemd-journald_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_systemd-journald_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_log_rotation">
            <xccdf-1.2:title>Ensure All Logs are Rotated by logrotate</xccdf-1.2:title>
            <xccdf-1.2:description>
Edit the file <html:code>/etc/logrotate.d/syslog</html:code>. Find the first

line, which should look like this (wrapped for clarity):
<html:pre>/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
  /var/log/boot.log /var/log/cron {</html:pre>
Edit this line so that it contains a one-space-separated
listing of each log file referenced in <html:code>/etc/rsyslog.conf</html:code>.
<html:br/>
       <html:br/>
All logs in use on a system must be rotated regularly, or the
log files will consume disk space over time, eventually interfering
with system operation. The file <html:code>/etc/logrotate.d/syslog</html:code> is the
configuration file used by the <html:code>logrotate</html:code> program to maintain all
log files written by <html:code>syslog</html:code>. By default, it rotates logs weekly and
stores four archival copies of each log. These settings can be
modified by editing <html:code>/etc/logrotate.conf</html:code>, but the defaults are
sufficient for purposes of this guide.
<html:br/>
       <html:br/>
Note that <html:code>logrotate</html:code> is run nightly by the cron job
<html:code>/etc/cron.daily/logrotate</html:code>. If particularly active logs need to be
rotated more often than once a day, some other mechanism must be
used.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_logrotate_installed" severity="medium">
              <xccdf-1.2:title>Ensure logrotate is Installed</xccdf-1.2:title>
              <xccdf-1.2:description>logrotate is installed by default. The <html:code>logrotate</html:code> package can be installed with the following command: <html:pre> $ sudo yum install logrotate</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The logrotate package provides the logrotate services.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_logrotate_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "logrotate" ; then
    yum install -y "logrotate"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_logrotate_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_logrotate_installed

- name: Ensure logrotate is installed
  package:
    name: logrotate
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_logrotate_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_logrotate_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_logrotate

class install_logrotate {
  package { 'logrotate':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_logrotate_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=logrotate
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_logrotate_installed">
[[packages]]
name = "logrotate"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_logrotate_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_logrotate_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" severity="medium">
              <xccdf-1.2:title>Ensure Logrotate Runs Periodically</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>logrotate</html:code> utility allows for the automatic rotation of
log files.  The frequency of rotation is specified in <html:code>/etc/logrotate.conf</html:code>,
which triggers a cron task or a timer.  To configure logrotate to run daily, add or correct
the following line in <html:code>/etc/logrotate.conf</html:code>:
<html:pre># rotate log files <html:i>frequency</html:i>
daily</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_logrotate"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ensure_logrotate_activated"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q logrotate; }; then

LOGROTATE_CONF_FILE="/etc/logrotate.conf"

if ! rpm -q --quiet "crontabs" ; then
    yum install -y "crontabs"
fi
CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate"


# daily rotation is configured
grep -q "^daily$" $LOGROTATE_CONF_FILE|| echo "daily" &gt;&gt; $LOGROTATE_CONF_FILE

# remove any line configuring weekly, monthly or yearly rotation
sed -i '/^\s*\(weekly\|monthly\|yearly\).*$/d' $LOGROTATE_CONF_FILE


# configure cron.daily if not already
if ! grep -q "^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" $CRON_DAILY_LOGROTATE_FILE; then
	echo '#!/bin/sh' &gt; $CRON_DAILY_LOGROTATE_FILE
	echo "/usr/sbin/logrotate $LOGROTATE_CONF_FILE" &gt;&gt; $CRON_DAILY_LOGROTATE_FILE
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ensure_logrotate_activated" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - configure_strategy
  - ensure_logrotate_activated
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure daily log rotation in /etc/logrotate.conf
  lineinfile:
    create: true
    dest: /etc/logrotate.conf
    regexp: ^daily$
    line: daily
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"logrotate" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - configure_strategy
  - ensure_logrotate_activated
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Make sure daily log rotation setting is not overriden in /etc/logrotate.conf
  lineinfile:
    create: false
    dest: /etc/logrotate.conf
    regexp: ^[\s]*(weekly|monthly|yearly)$
    state: absent
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"logrotate" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - configure_strategy
  - ensure_logrotate_activated
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure cron.daily if not already
  block:

  - name: Add shebang
    lineinfile:
      path: /etc/cron.daily/logrotate
      line: '#!/bin/sh'
      insertbefore: BOF
      create: true

  - name: Add logrotate call
    lineinfile:
      path: /etc/cron.daily/logrotate
      line: /usr/sbin/logrotate /etc/logrotate.conf
      regexp: ^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"logrotate" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - configure_strategy
  - ensure_logrotate_activated
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ensure_logrotate_activated:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_timer_logrotate_enabled" severity="medium">
              <xccdf-1.2:title>Enable logrotate Timer</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>logrotate</html:code> timer can be enabled with the following command:
<html:pre>$ sudo systemctl enable logrotate.timer</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#os_linux_ol_gt_or_eq_9_and_package_logrotate"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="timer_logrotate_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ( grep -qP "^ID=[\"']?ol[\"']?$" "/etc/os-release" &amp;&amp; { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="9"; printf "%s\n%s" "$expected" "$real" | sort -VC; } &amp;&amp; rpm --quiet -q logrotate ); }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'logrotate.timer'
fi
"$SYSTEMCTL_EXEC" enable 'logrotate.timer'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="timer_logrotate_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - timer_logrotate_enabled

- name: Enable timer logrotate
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable timer logrotate
    systemd:
      name: logrotate.timer
      enabled: 'yes'
      state: started
    when:
    - '"logrotate" in ansible_facts.packages'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( ansible_distribution == 'OracleLinux' and ansible_distribution_version is version('9',
    '&gt;=') and "logrotate" in ansible_facts.packages )
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - timer_logrotate_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-timer_logrotate_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-timer_logrotate_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages">
            <xccdf-1.2:title>Configure rsyslogd to Accept Remote Messages If Acting as a Log Server</xccdf-1.2:title>
            <xccdf-1.2:description>By default, <html:code>rsyslog</html:code> does not listen over the network
for log messages. If needed, modules can be enabled to allow
the rsyslog daemon to receive messages from other systems and for the system
thus to act as a log server.
If the system is not a log server, then lines concerning these modules
should remain commented out.
<html:br/>
       <html:br/>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_syslogng_installed" severity="medium">
              <xccdf-1.2:title>Ensure syslog-ng is Installed</xccdf-1.2:title>
              <xccdf-1.2:description>syslog-ng can be installed in replacement of rsyslog.
The <html:code>syslog-ng-core</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install syslog-ng-core</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The syslog-ng-core package provides the syslog-ng daemon, which provides
system logging services.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "syslog-ng" ; then
    yum install -y "syslog-ng"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_syslogng_installed

- name: Ensure syslog-ng is installed
  package:
    name: syslog-ng
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_syslogng_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_syslog-ng

class install_syslog-ng {
  package { 'syslog-ng':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_syslogng_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=syslog-ng
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_syslogng_installed">
[[packages]]
name = "syslog-ng"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_syslogng_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_syslogng_enabled" severity="medium">
              <xccdf-1.2:title>Enable syslog-ng Service</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>syslog-ng</html:code> service (in replacement of rsyslog) provides syslog-style logging by default on Debian.

The <html:code>syslog-ng</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable syslog-ng.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001311</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001312</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>syslog-ng</html:code> service must be running in order to provide
logging services, which are essential to system administration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_syslogng_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'syslog-ng.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'syslog-ng.service'
fi
"$SYSTEMCTL_EXEC" enable 'syslog-ng.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_syslogng_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_syslogng_enabled

- name: Enable syslog-ng Service - Enable service syslog-ng
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable syslog-ng Service - Enable Service syslog-ng
    ansible.builtin.systemd:
      name: syslog-ng
      enabled: true
      state: started
      masked: false
    when:
    - '"syslog-ng" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_syslogng_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_syslogng_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_syslog-ng

class enable_syslog-ng {
  service {'syslog-ng':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_syslogng_enabled">
[customizations.services]
enabled = ["syslog-ng"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_syslogng_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_tcp" severity="unknown">
              <xccdf-1.2:title>Enable rsyslog to Accept Messages via TCP, if Acting As Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code>/etc/rsyslog.conf</html:code> to enable reception of messages over TCP:
<html:pre>$ModLoad imtcp
$InputTCPServerRun 514</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the system needs to act as a log server, this ensures that it can receive
messages over a reliable TCP connection.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_accept_remote_messages_udp" severity="unknown">
              <xccdf-1.2:title>Enable rsyslog to Accept Messages via UDP, if Acting As Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsyslog</html:code> daemon should not accept remote messages
unless the system acts as a log server.
If the system needs to act as a central log server, add the following lines to
<html:code>/etc/rsyslog.conf</html:code> to enable reception of messages over UDP:
<html:pre>$ModLoad imudp
$UDPServerRun 514</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-6(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Many devices, such as switches, routers, and other Unix-like systems, may only support
the traditional syslog transmission over UDP. If the system must act as a log server,
this enables it to receive their messages as well.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" severity="medium">
              <xccdf-1.2:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsyslog</html:code> daemon should not accept remote messages unless the system acts as a log
server. To ensure that it is not listening on the network, ensure any of the following lines
are <html:i>not</html:i> found in <html:code>rsyslog</html:code> configuration files.

If using legacy syntax:
<html:pre>$ModLoad imtcp
$InputTCPServerRun <html:i>port</html:i>
$ModLoad imudp
$UDPServerRun <html:i>port</html:i>
$ModLoad imrelp
$InputRELPServerRun <html:i>port</html:i>
        </html:pre>

If using RainerScript syntax:
<html:pre>module(load="imtcp")
module(load="imudp")
input(type="imtcp" port="514")
input(type="imudp" port="514")
</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005030</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271857r1092283_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Any process which receives messages from the network incurs some risk of receiving malicious
messages. This risk can be eliminated for rsyslog by configuring it not to listen on the
network.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_nolisten" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

legacy_regex='^\s*\$(((Input(TCP|RELP)|UDP)ServerRun)|ModLoad\s+(imtcp|imudp|imrelp))'
rainer_regex='^\s*(module|input)\((load|type)="(imtcp|imudp)".*$'

readarray -t legacy_targets &lt; &lt;(grep -l -E -r "${legacy_regex[@]}" /etc/rsyslog.conf /etc/rsyslog.d/)
readarray -t rainer_targets &lt; &lt;(grep -l -E -r "${rainer_regex[@]}" /etc/rsyslog.conf /etc/rsyslog.d/)

config_changed=false
if [ ${#legacy_targets[@]} -gt 0 ]; then
    for target in "${legacy_targets[@]}"; do
        sed -E -i "/$legacy_regex/ s/^/# /" "$target"
    done
    config_changed=true
fi

if [ ${#rainer_targets[@]} -gt 0 ]; then
    for target in "${rainer_targets[@]}"; do
        sed -E -i "/$rainer_regex/ s/^/# /" "$target"
    done
    config_changed=true
fi

if $config_changed; then
    systemctl restart rsyslog.service
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_nolisten" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Define Rsyslog Config Lines Regex in Legacy Syntax
  ansible.builtin.set_fact:
    rsyslog_listen_legacy_regex: ^\s*\$(((Input(TCP|RELP)|UDP)ServerRun)|ModLoad\s+(imtcp|imudp|imrelp))
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for Legacy Config Lines in Rsyslog Main Config File
  ansible.builtin.find:
    paths: /etc
    pattern: rsyslog.conf
    contains: '{{ rsyslog_listen_legacy_regex }}'
  register: rsyslog_listen_legacy_main_file
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for Legacy Config Lines in Rsyslog Include Files
  ansible.builtin.find:
    paths: /etc/rsyslog.d/
    pattern: '*.conf'
    contains: '{{ rsyslog_listen_legacy_regex }}'
  register: rsyslog_listen_legacy_include_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Assemble List of Config Files With Listen Lines in Legacy Syntax
  ansible.builtin.set_fact:
    rsyslog_legacy_remote_listen_files: '{{ rsyslog_listen_legacy_main_file.files
      | map(attribute=''path'') | list + rsyslog_listen_legacy_include_files.files
      | map(attribute=''path'') | list }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Comment Listen Config Lines Wherever Defined Using Legacy Syntax
  ansible.builtin.replace:
    path: '{{ item }}'
    regexp: '{{ rsyslog_listen_legacy_regex }}'
    replace: '# \1'
  loop: '{{ rsyslog_legacy_remote_listen_files }}'
  register: rsyslog_listen_legacy_comment
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_legacy_remote_listen_files | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Define Rsyslog Config Lines Regex in RainerScript Syntax
  ansible.builtin.set_fact:
    rsyslog_listen_rainer_regex: ^\s*(module|input)\((load|type)="(imtcp|imudp)".*$
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for RainerScript Config Lines in Rsyslog Main Config File
  ansible.builtin.find:
    paths: /etc
    pattern: rsyslog.conf
    contains: '{{ rsyslog_listen_rainer_regex }}'
  register: rsyslog_rainer_remote_main_file
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for RainerScript Config Lines in Rsyslog Include Files
  ansible.builtin.find:
    paths: /etc/rsyslog.d/
    pattern: '*.conf'
    contains: '{{ rsyslog_listen_rainer_regex }}'
  register: rsyslog_rainer_remote_include_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Assemble List of Config Files With Listen Lines in RainerScript
  ansible.builtin.set_fact:
    rsyslog_rainer_remote_listen_files: '{{ rsyslog_rainer_remote_main_file.files
      | map(attribute=''path'') | list + rsyslog_rainer_remote_include_files.files
      | map(attribute=''path'') | list }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Comment Listen Config Lines Wherever Defined Using RainerScript
  ansible.builtin.replace:
    path: '{{ item }}'
    regexp: '{{ rsyslog_listen_rainer_regex }}'
    replace: '# \1'
  loop: '{{ rsyslog_rainer_remote_listen_files }}'
  register: rsyslog_listen_rainer_comment
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_rainer_remote_listen_files | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Restart Rsyslog if Any Line Were Commented Out
  ansible.builtin.service:
    name: rsyslog
    state: restarted
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_listen_legacy_comment is changed or rsyslog_listen_rainer_comment is changed
  tags:
  - DISA-STIG-OL09-00-005030
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_nolisten:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rsyslog_sending_messages">
            <xccdf-1.2:title>Rsyslog Logs Sent To Remote Host</xccdf-1.2:title>
            <xccdf-1.2:description>If system logs are to be useful in detecting malicious
activities, it is necessary to send logs to a remote server. An
intruder who has compromised the root account on a system may
delete the log entries which indicate that the system was attacked
before they are seen by an administrator.
<html:br/>
       <html:br/>
However, it is recommended that logs be stored on the local
host in addition to being sent to the loghost, especially if
<html:code>rsyslog</html:code> has been configured to use the UDP protocol to send
messages over a network. UDP does not guarantee reliable delivery,
and moderately busy sites will lose log messages occasionally,
especially in periods of high traffic which may be the result of an
attack. In addition, remote <html:code>rsyslog</html:code> messages are not
authenticated in any way by default, so it is easy for an attacker to
introduce spurious messages to the central log server. Also, some
problems cause loss of network connectivity, which will prevent the
sending of messages to the central server. For all of these reasons, it is
better to store log messages both centrally and on each host, so
that they can be correlated if necessary.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" type="string" interactive="true">
              <xccdf-1.2:title>Remote Log Server</xccdf-1.2:title>
              <xccdf-1.2:description>Specify an URI or IP address of a remote host where the log messages will be sent and stored.</xccdf-1.2:description>
              <xccdf-1.2:value>logcollector</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" severity="medium">
              <xccdf-1.2:title>Ensure Logs Sent To Remote Host</xccdf-1.2:title>
              <xccdf-1.2:description>To configure rsyslog to send logs to a remote log server,
open <html:code>/etc/rsyslog.conf</html:code> and read and understand the last section of the file,
which describes the multiple directives necessary to activate remote
logging.
Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting <html:code><html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:code> appropriately.
The choice of protocol depends on the environment of the system;
although TCP and RELP provide more reliable message delivery,
they may not be supported in all environments.
<html:br/>
To use UDP for log message delivery:
<html:pre>*.* @<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>
        </html:pre>
        <html:br/>
To use TCP for log message delivery:
<html:pre>*.* @@<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>
        </html:pre>
        <html:br/>
To use RELP for log message delivery:
<html:pre>*.* :omrelp:<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>
        </html:pre>
        <html:br/>
There must be a resolvable DNS CNAME or Alias record set to "<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>" for logs to be sent correctly to the centralized logging utility.</xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">It is important to configure queues in case the client is sending log
messages to a remote server. If queues are not configured,
the system will stop functioning when the connection
to the remote server is not available. Please consult Rsyslog
documentation for more information about configuration of queues. The
example configuration which should go into <html:code>/etc/rsyslog.conf</html:code>
can look like the following lines:
<html:pre>
$ActionQueueType LinkedList
$ActionQueueFileName queuefilename
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionResumeRetryCount -1
</html:pre>
       </xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-005005</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271852r1092608_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A log server (loghost) receives syslog messages from one or more
systems. This data can be used as an additional log source in the event a
system is compromised and its local logs are suspect. Forwarding log messages
to a remote loghost also provides system administrators with a centralized
place to view the status of multiple hosts within the enterprise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_remote_loghost"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

rsyslog_remote_loghost_address='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^\*\.\*")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "@@$rsyslog_remote_loghost_address"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^\*\.\*\\&gt;" "/etc/rsyslog.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^\*\.\*\\&gt;.*/$escaped_formatted_output/gi" "/etc/rsyslog.conf"
else
    if [[ -s "/etc/rsyslog.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/rsyslog.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/rsyslog.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/rsyslog.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_remote_loghost" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-005005
  - NIST-800-53-AU-4(1)
  - NIST-800-53-AU-9(2)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - rsyslog_remote_loghost
- name: XCCDF Value rsyslog_remote_loghost_address # promote to variable
  set_fact:
    rsyslog_remote_loghost_address: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>
  tags:
    - always

- name: Set rsyslog remote loghost
  lineinfile:
    dest: /etc/rsyslog.conf
    regexp: ^\*\.\*
    line: '*.* @@{{ rsyslog_remote_loghost_address }}'
    create: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-005005
  - NIST-800-53-AU-4(1)
  - NIST-800-53-AU-9(2)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - rsyslog_remote_loghost
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_remote_loghost:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls" severity="medium">
              <xccdf-1.2:title>Configure TLS for rsyslog remote logging</xccdf-1.2:title>
              <xccdf-1.2:description>Configure <html:code>rsyslog</html:code> to use Transport Layer
Security (TLS) support for logging to remote server
for the Forwarding Output Module in <html:code>/etc/rsyslog.conf</html:code>
using action. You can use the following command:
<html:pre>echo 'action(type="omfwd" protocol="tcp" Target="&lt;remote system&gt;" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' &gt;&gt; /etc/rsyslog.conf
</html:pre>
Replace the <html:code>&lt;remote system&gt;</html:code> in the above command with an IP address or a host name of the remote logging server.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:rationale>For protection of data being logged, the connection to the
remote logging server needs to be authenticated and encrypted.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="rsyslog_remote_tls" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

rsyslog_remote_loghost_address='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>'

params_to_add_if_missing=("protocol" "target" "port" "StreamDriver" "StreamDriverMode" "StreamDriverAuthMode" "streamdriver.CheckExtendedKeyPurpose")
values_to_add_if_missing=("tcp" "$rsyslog_remote_loghost_address" "6514" "gtls" "1" "x509/name" "on")
params_to_replace_if_wrong_value=("protocol" "StreamDriver" "StreamDriverMode" "StreamDriverAuthMode" "streamdriver.CheckExtendedKeyPurpose")
values_to_replace_if_wrong_value=("tcp" "gtls" "1" "x509/name" "on")

files_containing_omfwd=("$(grep -ilE '^[^#]*\s*action\s*\(\s*type\s*=\s*"omfwd".*' /etc/rsyslog.conf /etc/rsyslog.d/*.conf)")
if [ -n "${files_containing_omfwd[*]}" ]; then
    for file in "${files_containing_omfwd[@]}"; do
        for ((i=0; i&lt;${#params_to_replace_if_wrong_value[@]}; i++)); do
            sed -i -E -e 'H;$!d;x;s/^\n//' -e "s|(\s*action\s*\(\s*type\s*=\s*[\"]omfwd[\"].*?)${params_to_replace_if_wrong_value[$i]}\s*=\s*[\"]\S*[\"](.*\))|\1${params_to_replace_if_wrong_value[$i]}=\"${values_to_replace_if_wrong_value[$i]}\"\2|gI" "$file"
        done
        for ((i=0; i&lt;${#params_to_add_if_missing[@]}; i++)); do
            if ! grep -qPzi "(?s)\s*action\s*\(\s*type\s*=\s*[\"]omfwd[\"].*?${params_to_add_if_missing[$i]}.*?\).*" "$file"; then
                sed -i -E -e 'H;$!d;x;s/^\n//' -e "s|(\s*action\s*\(\s*type\s*=\s*[\"]omfwd[\"])|\1\n${params_to_add_if_missing[$i]}=\"${values_to_add_if_missing[$i]}\"|gI" "$file"
            fi
        done
    done
else
    echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"$rsyslog_remote_loghost_address\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")"  &gt;&gt; /etc/rsyslog.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="rsyslog_remote_tls" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls
- name: XCCDF Value rsyslog_remote_loghost_address # promote to variable
  set_fact:
    rsyslog_remote_loghost_address: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>
  tags:
    - always

- name: 'Configure TLS for rsyslog remote logging: search for omfwd action directive
    in rsyslog include files'
  ansible.builtin.find:
    paths: /etc/rsyslog.d/
    pattern: '*.conf'
    contains: ^\s*action\s*\(\s*type\s*=\s*"omfwd".*
  register: rsyslog_includes_with_directive
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: search for omfwd action directive
    in rsyslog main config file'
  ansible.builtin.find:
    paths: /etc
    pattern: rsyslog.conf
    contains: ^\s*action\s*\(\s*type\s*=\s*"omfwd".*
  register: rsyslog_main_file_with_directive
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: declare Rsyslog option parameters
    to be inserted if entirely missing'
  ansible.builtin.set_fact:
    rsyslog_parameters_to_add_if_missing:
    - protocol
    - target
    - port
    - StreamDriver
    - StreamDriverMode
    - StreamDriverAuthMode
    - streamdriver.CheckExtendedKeyPurpose
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: declare Rsyslog option values to
    be inserted if entirely missing'
  ansible.builtin.set_fact:
    rsyslog_values_to_add_if_missing:
    - tcp
    - '{{ rsyslog_remote_loghost_address }}'
    - '6514'
    - gtls
    - '1'
    - x509/name
    - 'on'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: declare Rsyslog option parameters
    to be replaced if defined with wrong values'
  ansible.builtin.set_fact:
    rsyslog_parameters_to_replace_if_wrong_value:
    - protocol
    - StreamDriver
    - StreamDriverMode
    - StreamDriverAuthMode
    - streamdriver.CheckExtendedKeyPurpose
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: declare Rsyslog option values to
    be replaced when having wrong value'
  ansible.builtin.set_fact:
    rsyslog_values_to_replace_if_wrong_value:
    - tcp
    - gtls
    - '1'
    - x509/name
    - 'on'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: assemble list of files with existing
    directives'
  ansible.builtin.set_fact:
    rsyslog_files: '{{ rsyslog_includes_with_directive.files | map(attribute=''path'')
      | list + rsyslog_main_file_with_directive.files | map(attribute=''path'') |
      list }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: try to fix existing directives'
  block:

  - name: 'Configure TLS for rsyslog remote logging: Fix existing omfwd directives
      by adjusting the value'
    ansible.builtin.replace:
      path: '{{ item[0] }}'
      regexp: (?i)^(\s*action\s*\(\s*type\s*=\s*"omfwd"[\s\S]*)({{ item[1][0] | regex_escape()
        }}\s*=\s*"\S*")([\s\S]*\))$
      replace: \1{{ item[1][0] }}="{{ item[1][1] }}"\3
    loop: '{{ rsyslog_files | product (rsyslog_parameters_to_replace_if_wrong_value
      | zip(rsyslog_values_to_replace_if_wrong_value)) | list }}'

  - name: 'Configure TLS for rsyslog remote logging: Fix existing omfwd directives
      by adding parameter and value'
    ansible.builtin.replace:
      path: '{{ item[0] }}'
      regexp: (?i)^(\s*action\s*\(\s*type\s*=\s*"omfwd"(?:[\s\S](?!{{ item[1][0] |
        regex_escape() }}))*.)(\))$
      replace: \1 {{ item[1][0] }}="{{ item[1][1] }}" \2
    loop: '{{ rsyslog_files | product (rsyslog_parameters_to_add_if_missing | zip(rsyslog_values_to_add_if_missing))
      | list }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - rsyslog_includes_with_directive.matched or rsyslog_main_file_with_directive.matched
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls

- name: 'Configure TLS for rsyslog remote logging: Add missing rsyslog directive'
  ansible.builtin.lineinfile:
    dest: /etc/rsyslog.conf
    line: action(type="omfwd" protocol="tcp" Target="{{ rsyslog_remote_loghost_address
      }}" port="6514" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name"
      streamdriver.CheckExtendedKeyPurpose="on")
    create: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not rsyslog_includes_with_directive.matched and not rsyslog_main_file_with_directive.matched
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_remote_tls
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_remote_tls:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_remote_tls_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_rsyslog_remote_tls_cacert" severity="medium">
              <xccdf-1.2:title>Configure CA certificate for rsyslog remote logging</xccdf-1.2:title>
              <xccdf-1.2:description>Configure CA certificate for <html:code>rsyslog</html:code> logging
to remote server using Transport Layer Security (TLS)
using correct path for the <html:code>DefaultNetstreamDriverCAFile</html:code>
global option in <html:code>/etc/rsyslog.conf</html:code>, for example with the following command:
<html:pre>echo 'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")' &gt;&gt; /etc/rsyslog.conf</html:pre>
Replace the <html:code>/etc/pki/tls/cert.pem</html:code> in the above command with the path to the file with CA certificate generated for the purpose of remote logging.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation is not available as each organization has unique requirements. </xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The CA certificate needs to be set or <html:code>rsyslog.service</html:code>
fails to start with
<html:pre>error: ca certificate is not set, cannot continue</html:pre>
       </xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-rsyslog_remote_tls_cacert:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-rsyslog_remote_tls_cacert_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network">
          <xccdf-1.2:title>Network Configuration and Firewalls</xccdf-1.2:title>
          <xccdf-1.2:description>Most systems must be connected to a network of some
sort, and this brings with it the substantial risk of network
attack. This section discusses the security impact of decisions
about networking which must be made when configuring a system.
<html:br/>
      <html:br/>
This section also discusses firewalls, network access
controls, and other network security frameworks, which allow
system-level rules to be written that can limit an attackers' ability
to connect to your system. These rules can specify that network
traffic should be allowed or denied from certain IP addresses,
hosts, and networks. The rules can also specify which of the
system's network services are available to particular hosts or
networks.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_configure_name_resolution" severity="medium">
            <xccdf-1.2:title>Configure Multiple DNS Servers in /etc/resolv.conf</xccdf-1.2:title>
            <xccdf-1.2:description>
Determine whether the system is using local or DNS name resolution with the
following command:
<html:pre>$ sudo grep hosts /etc/nsswitch.conf
hosts: files dns</html:pre>
If the DNS entry is missing from the host's line in the "/etc/nsswitch.conf"
file, the "/etc/resolv.conf" file must be empty.
Verify the "/etc/resolv.conf" file is empty with the following command:
<html:pre>$ sudo ls -al /etc/resolv.conf
-rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf</html:pre>
If the DNS entry is found on the host's line of the "/etc/nsswitch.conf" file,
then verify the following:<html:br/>

Multiple Domain Name System (DNS) Servers should be configured
in <html:code>/etc/resolv.conf</html:code>. This provides redundant name resolution services
in the event that a domain server crashes. To configure the system to contain
as least <html:code>2</html:code> DNS servers, add a corresponding <html:code>nameserver
<html:i>ip_address</html:i>
       </html:code> entry in <html:code>/etc/resolv.conf</html:code> for each DNS
server where <html:i>ip_address</html:i> is the IP address of a valid DNS server.
For example:
<html:pre>search example.com
nameserver 192.168.0.1
nameserver 192.168.0.2</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, the IP addresses of local authoritative name servers need to be added by the administrator.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-20(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006003</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271861r1092295_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>To provide availability for name resolution services, multiple redundant
name servers are mandated. A failure in name resolution could lead to the
failure of security functions requiring name resolution, which may include
time synchronization, centralized authentication, and remote system logging.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-network_configure_name_resolution:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-network_configure_name_resolution_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_nmcli_permissions" severity="medium">
            <xccdf-1.2:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</xccdf-1.2:title>
            <xccdf-1.2:description>By default, non-privileged users are given permissions to modify networking
interfaces and configurations using the <html:code>nmcli</html:code> command. Non-privileged
users should not be making configuration changes to network configurations. To
ensure that non-privileged users do not have permissions to make changes to the
network configuration using <html:code>nmcli</html:code>, create the following configuration in
<html:code>/etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla</html:code>:
<html:pre>
[Disable General User Access to NetworkManager]
Identity=default
Action=org.freedesktop.NetworkManager.*
ResultAny=no
ResultInactive=no
ResultActive=auth_admin
</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Allowing non-privileged users to make changes to network settings can allow
untrusted access, prevent system availability, and/or can lead to a compromise or
attack.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_polkit"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="network_nmcli_permissions" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q polkit; then

printf "[Disable General User Access to NetworkManager]\nIdentity=default\nAction=org.freedesktop.NetworkManager.*\nResultAny=no\nResultInactive=no\nResultActive=auth_admin\n" &gt; /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="network_nmcli_permissions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - network_nmcli_permissions
  - no_reboot_needed
  - restrict_strategy

- name: Ensure non-privileged users do not have access to nmcli
  ini_file:
    path: /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla
    section: Disable General User Access to NetworkManager
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    no_extra_spaces: true
    create: true
  loop:
  - option: Identity
    value: default
  - option: Action
    value: org.freedesktop.NetworkManager.*
  - option: ResultAny
    value: 'no'
  - option: ResultInactive
    value: 'no'
  - option: ResultActive
    value: auth_admin
  when: '"polkit" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - network_nmcli_permissions
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-network_nmcli_permissions:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-network_nmcli_permissions_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" severity="medium">
            <xccdf-1.2:title>Ensure System is Not Acting as a Network Sniffer</xccdf-1.2:title>
            <xccdf-1.2:description>The system should not be acting as a network sniffer, which can
capture all traffic on the network to which it is connected. Run the following
to determine if any interface is running in promiscuous mode:
<html:pre>$ ip link | grep PROMISC</html:pre>
Promiscuous mode of an interface can be disabled with the following command:
<html:pre>$ sudo ip link set dev <html:code>device_name</html:code> multicast off promisc off</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI09.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI09.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI09.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271862r1092298_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Network interfaces in promiscuous mode allow for the capture of all network traffic
visible to the system. If unauthorized individuals can access these applications, it
may allow them to collect information such as logon IDs, passwords, and key exchanges
between systems.
<html:br/>
       <html:br/>
If the system is being used to perform a network troubleshooting function, the use of these
tools must be documented with the Information Systems Security Manager (ISSM) and restricted
to only authorized personnel.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#machine"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="network_sniffer_disabled" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

for interface in $(ip -o link show | cut -d ":" -f 2); do
    ip link set dev $interface multicast off promisc off
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="network_sniffer_disabled" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Ensure System is Not Acting as a Network Sniffer - Gather network interfaces
  ansible.builtin.command:
    cmd: ip -o link show
  register: network_interfaces
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - DISA-STIG-OL09-00-006004
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(2)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MA-3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - low_complexity
  - low_disruption
  - medium_severity
  - network_sniffer_disabled
  - no_reboot_needed
  - restrict_strategy

- name: Ensure System is Not Acting as a Network Sniffer - Disable promiscuous mode
  ansible.builtin.command:
    cmd: ip link set dev {{ item.split(':')[1] }} multicast off promisc off
  loop: '{{ network_interfaces.stdout_lines }}'
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - network_interfaces.stdout_lines is defined and "item.split(':') | length == 3"
  tags:
  - DISA-STIG-OL09-00-006004
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(2)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MA-3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - low_complexity
  - low_disruption
  - medium_severity
  - network_sniffer_disabled
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-network_sniffer_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-firewalld">
            <xccdf-1.2:title>firewalld</xccdf-1.2:title>
            <xccdf-1.2:description>The dynamic firewall daemon <html:code>firewalld</html:code> provides a
dynamically managed firewall with support for network “zones” to assign
a level of trust to a network and its associated connections and interfaces.
It has support for IPv4 and IPv6 firewall settings. It supports Ethernet
bridges and has a separation of runtime and permanent configuration options.
It also has an interface for services or applications to add firewall rules
directly.
<html:br/>
A graphical configuration tool, <html:code>firewall-config</html:code>, is used to configure
<html:code>firewalld</html:code>, which in turn uses <html:code>iptables</html:code> tool to communicate
with <html:code>Netfilter</html:code> in the kernel which implements packet filtering.
<html:br/>
The firewall service provided by <html:code>firewalld</html:code> is dynamic rather than
static because changes to the configuration can be made at anytime and are
immediately implemented. There is no need to save or apply the changes. No
unintended disruption of existing network connections occurs as no part of
the firewall has to be reloaded.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_firewalld-backend" severity="medium">
              <xccdf-1.2:title>Configure Firewalld to Use the Nftables Backend</xccdf-1.2:title>
              <xccdf-1.2:description>Firewalld can be configured with many backends, such as nftables.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000420-GPOS-00186</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006000</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271858r1092286_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Nftables is modern kernel module for controling network connections coming into a system.
Utilizing the limit statement in "nftables" can help to mitigate DoS attacks.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_firewalld"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="firewalld-backend" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q firewalld; }; then

if [ -e "/etc/firewalld/firewalld.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*FirewallBackend\s*=\s*/d" "/etc/firewalld/firewalld.conf"
else
    touch "/etc/firewalld/firewalld.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/firewalld/firewalld.conf"

cp "/etc/firewalld/firewalld.conf" "/etc/firewalld/firewalld.conf.bak"
# Insert before the line matching the regex '^#\s*FirewallBackend'.
line_number="$(LC_ALL=C grep -n "^#\s*FirewallBackend" "/etc/firewalld/firewalld.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^#\s*FirewallBackend', insert at
    # the end of the file.
    printf '%s\n' "FirewallBackend=nftables" &gt;&gt; "/etc/firewalld/firewalld.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/firewalld/firewalld.conf.bak" &gt; "/etc/firewalld/firewalld.conf"
    printf '%s\n' "FirewallBackend=nftables" &gt;&gt; "/etc/firewalld/firewalld.conf"
    tail -n "+$(( line_number ))" "/etc/firewalld/firewalld.conf.bak" &gt;&gt; "/etc/firewalld/firewalld.conf"
fi
# Clean up after ourselves.
rm "/etc/firewalld/firewalld.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="firewalld-backend" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006000
  - NIST-800-53-SC-5
  - firewalld-backend
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Setting unquoted shell-style assignment of 'FirewallBackend' to 'nftables'
    in '/etc/firewalld/firewalld.conf'
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/firewalld/firewalld.conf
      create: true
      regexp: (?i)^\s*FirewallBackend=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/firewalld/firewalld.conf
    lineinfile:
      path: /etc/firewalld/firewalld.conf
      create: true
      regexp: (?i)^\s*FirewallBackend=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/firewalld/firewalld.conf
    lineinfile:
      path: /etc/firewalld/firewalld.conf
      create: true
      regexp: (?i)^\s*FirewallBackend=
      line: FirewallBackend=nftables
      state: present
      insertbefore: ^# FirewallBackend
      validate: /usr/bin/bash -n %s
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"firewalld" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-006000
  - NIST-800-53-SC-5
  - firewalld-backend
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-firewalld-backend:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-firewalld-backend_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_firewalld_activation">
              <xccdf-1.2:title>Inspect and Activate Default firewalld Rules</xccdf-1.2:title>
              <xccdf-1.2:description>Firewalls can be used to separate networks into different zones
based on the level of trust the user has decided to place on the devices and
traffic within that network. <html:code>NetworkManager</html:code> informs firewalld to which
zone an interface belongs. An interface's assigned zone can be changed by
<html:code>NetworkManager</html:code> or via the <html:code>firewall-config</html:code> tool.
<html:br/>
The zone settings in <html:code>/etc/firewalld/</html:code> are a range of preset settings
which can be quickly applied to a network interface. These are the zones
provided by firewalld sorted according to the default trust level of the
zones from untrusted to trusted:
<html:ul><html:li><html:code>drop</html:code><html:br/><html:p>Any incoming network packets are dropped, there is no
reply. Only outgoing network connections are possible.</html:p></html:li><html:li><html:code>block</html:code><html:br/><html:p>Any incoming network connections are rejected with an
<html:code>icmp-host-prohibited</html:code> message for IPv4 and <html:code>icmp6-adm-prohibited</html:code>
for IPv6. Only network connections initiated from within the system are
possible.</html:p></html:li><html:li><html:code>public</html:code><html:br/><html:p>For use in public areas. You do not trust the other
computers on the network to not harm your computer. Only selected incoming
connections are accepted.</html:p></html:li><html:li><html:code>external</html:code><html:br/><html:p>For use on external networks with masquerading enabled
especially for routers. You do not trust the other computers on the network to
not harm your computer. Only selected incoming connections are accepted.</html:p></html:li><html:li><html:code>dmz</html:code><html:br/><html:p>For computers in your demilitarized zone that are
publicly-accessible with limited access to your internal network. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>work</html:code><html:br/><html:p>For use in work areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>home</html:code><html:br/><html:p>For use in home areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>internal</html:code><html:br/><html:p>For use on internal networks. You mostly trust the
other computers on the networks to not harm your computer. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>trusted</html:code><html:br/><html:p>All network connections are accepted.</html:p></html:li></html:ul>
        <html:br/>
It is possible to designate one of these zones to be the default zone. When
interface connections are added to <html:code>NetworkManager</html:code>, they are assigned
to the default zone. On installation, the default zone in firewalld is set to
be the public zone.
<html:br/>
To find out all the settings of a zone, for example the <html:code>public zone,</html:code>
enter the following command as root:
<html:pre># firewall-cmd --zone=public --list-all</html:pre>
Example output of this command might look like the following:
<html:pre>
# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench
</html:pre>
To view the network zones currently active, enter the following command as root:
<html:pre># firewall-cmd --get-service</html:pre>
The following listing displays the result of this command
on common Oracle Linux 9 system:
<html:pre>
# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https
</html:pre>
Finally to view the network zones that will be active after the next firewalld
service reload, enter the following command as root:
<html:pre># firewall-cmd --get-service --permanent</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_firewalld_installed" severity="medium">
                <xccdf-1.2:title>Install firewalld Package</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>firewalld</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install firewalld</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002322</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000298-GPOS-00116</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000220</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271469r1091119_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols.

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.

Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Oracle Linux 9 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_firewalld_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "firewalld" ; then
    yum install -y "firewalld"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_firewalld_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000220
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed

- name: Ensure firewalld is installed
  package:
    name: firewalld
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000220
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_firewalld_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_firewalld

class install_firewalld {
  package { 'firewalld':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_firewalld_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=firewalld
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_firewalld_installed">
[[packages]]
name = "firewalld"
version = "*"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_firewalld_installed:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_firewalld_installed_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" severity="medium">
                <xccdf-1.2:title>Verify firewalld Enabled</xccdf-1.2:title>
                <xccdf-1.2:description>
The <html:code>firewalld</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable firewalld.service</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00231</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A21</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000221</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271470r1092618_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_firewalld"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_firewalld_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q firewalld; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'firewalld.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'firewalld.service'
fi
"$SYSTEMCTL_EXEC" enable 'firewalld.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_firewalld_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000221
  - NIST-800-171-3.1.3
  - NIST-800-171-3.4.7
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_firewalld_enabled

- name: Verify firewalld Enabled - Enable service firewalld
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Verify firewalld Enabled - Enable Service firewalld
    ansible.builtin.systemd:
      name: firewalld
      enabled: true
      state: started
      masked: false
    when:
    - '"firewalld" in ansible_facts.packages'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"firewalld" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000221
  - NIST-800-171-3.1.3
  - NIST-800-171-3.4.7
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_firewalld_enabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_firewalld_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_firewalld

class enable_firewalld {
  service {'firewalld':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_firewalld_enabled">
[customizations.services]
enabled = ["firewalld"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_firewalld_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ruleset_modifications">
              <xccdf-1.2:title>Strengthen the Default Ruleset</xccdf-1.2:title>
              <xccdf-1.2:description>The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in configuration files under the <html:code>/etc/firewalld/services</html:code>
and <html:code>/etc/firewalld/zones</html:code> directories.
<html:br/>
        <html:br/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the <html:code>firewall-cmd</html:code> program to load in rules under the <html:code>/etc/firewalld/services</html:code>
and <html:code>/etc/firewalld/zones</html:code> directories.
<html:br/>
        <html:br/>
Instructions apply to both unless otherwise noted. Language and address
conventions for regular firewalld rules are used throughout this section.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The program <html:code>firewall-config</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts the <html:code>firewalld</html:code> ruleset(s).</xccdf-1.2:warning>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_firewalld_ports" severity="medium">
                <xccdf-1.2:title>Configure the Firewalld Ports</xccdf-1.2:title>
                <xccdf-1.2:description>Configure the <html:code>firewalld</html:code> ports to allow approved services to have access to the system.
To configure <html:code>firewalld</html:code> to open ports, run the following command:
<html:pre>firewall-cmd --permanent --add-port=<html:i>port_number/tcp</html:i>
         </html:pre>
To configure <html:code>firewalld</html:code> to allow access for pre-defined services, run the following
command:
<html:pre>firewall-cmd --permanent --add-service=<html:i>service_name</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1416</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000223</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271472r1091128_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In order to prevent unauthorized connection of devices, unauthorized transfer of information,
or unauthorized tunneling (i.e., embedding of data types within data types), organizations must
disable or restrict unused or unnecessary physical and logical ports/protocols on information
systems.
<html:br/>
         <html:br/>
Operating systems are capable of providing a wide variety of functions and services.
Some of the functions and services provided by default may not be necessary to support
essential organizational operations.
Additionally, it is sometimes convenient to provide multiple services from a single component
(e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by
one component.
<html:br/>
         <html:br/>
To support the requirements and principles of least functionality, the operating system must
support the organizational requirements, providing only essential capabilities and limiting the
use of ports, protocols, and/or services to only those required, authorized, and approved to
conduct official business.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_firewalld_ports_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny" severity="medium">
                <xccdf-1.2:title>Firewalld Must Employ a Deny-all, Allow-by-exception Policy for Allowing Connections to Other Systems</xccdf-1.2:title>
                <xccdf-1.2:description>Oracle Linux 9 incorporates the "firewalld" daemon, which allows for many different configurations. One of these configurations is zones.
Zones can be utilized to a deny-all, allow-by-exception approach.
The default "drop" zone will drop all incoming network packets unless it is explicitly allowed by the configuration file or is related to an outgoing network connection.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000224</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271473r1091131_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems.
It also permits outbound connections that may facilitate exfiltration of data.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configured_firewalld_default_deny_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted" severity="medium">
                <xccdf-1.2:title>Configure Firewalld to Restrict Loopback Traffic</xccdf-1.2:title>
                <xccdf-1.2:description>Configure <html:code>firewalld</html:code> to restrict loopback traffic to the <html:code>lo</html:code> interface.

The loopback traffic must be trusted by assigning the <html:code>lo</html:code> interface to the
<html:code>firewalld</html:code>
         <html:code>trusted</html:code> zone. However, the loopback traffic must be restricted
to the loopback interface as an anti-spoofing measure.

To configure <html:code>firewalld</html:code> to restrict loopback traffic to the <html:code>lo</html:code> interface,
run the following commands:
<html:pre>
sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop'
</html:pre>

To ensure <html:code>firewalld</html:code> settings are applied in runtime, run the following command:
<html:pre>firewall-cmd --reload</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Loopback traffic is generated between processes on machine and is typically critical to
operation of the system. The loopback interface is the only place that loopback network
traffic should be seen, all other interfaces should ignore traffic on this network as an
anti-spoofing measure.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="firewalld_loopback_traffic_restricted" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "firewalld" ; then
    yum install -y "firewalld"
fi

ipv4_rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
ipv6_rule='rule family=ipv6 source address="::1" destination not address="::1" drop'

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
    firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv4_rule}"
    firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv6_rule}"
elif systemctl is-active firewalld; then
    firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv4_rule}"
    firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv6_rule}"
    firewall-cmd --reload
else
    echo "
    firewalld service is not active. Remediation aborted!
    This remediation could not be applied because it depends on firewalld service running.
    The service is not started by this remediation in order to prevent connection issues."
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="firewalld_loopback_traffic_restricted" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Package
    is Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Collect Facts About System
    Services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Remediation is Applicable
    if firewalld Service is Running
  block:

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted
      Zone Restricts IPv4 Loopback Traffic
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4
        source address="127.0.0.1" destination not address="127.0.0.1" drop'
    register: result_trusted_ipv4_restriction
    changed_when:
    - '''ALREADY_ENABLED'' not in result_trusted_ipv4_restriction.stderr'

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted
      Zone Restricts IPv6 Loopback Traffic
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6
        source address="::1" destination not address="::1" drop'
    register: result_trusted_ipv6_restriction
    changed_when:
    - '''ALREADY_ENABLED'' not in result_trusted_ipv6_restriction.stderr'

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Changes
      are Applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_trusted_ipv4_restriction is changed or result_trusted_ipv6_restriction
      is changed
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.services['firewalld.service'].state == 'running'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Informative Message Based
    on Service State
  ansible.builtin.assert:
    that:
    - ansible_facts.services['firewalld.service'].state == 'running'
    fail_msg:
    - firewalld service is not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld service
      running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Configure Firewalld to Restrict Loopback Traffic remediation successfully executed
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-firewalld_loopback_traffic_restricted:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-firewalld_loopback_traffic_restricted_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted" severity="medium">
                <xccdf-1.2:title>Configure Firewalld to Trust Loopback Traffic</xccdf-1.2:title>
                <xccdf-1.2:description>Assign loopback interface to the <html:code>firewalld</html:code>
         <html:code>trusted</html:code> zone in order to
explicitly allow the loopback traffic in the system.

To configure <html:code>firewalld</html:code> to trust loopback traffic, run the following command:
<html:pre>sudo firewall-cmd --permanent --zone=trusted --add-interface=lo</html:pre>
To ensure <html:code>firewalld</html:code> settings are applied in runtime, run the following command:
<html:pre>firewall-cmd --reload</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Loopback traffic is generated between processes on machine and is typically critical to
operation of the system. The loopback interface is the only place that loopback network
traffic should be seen, all other interfaces should ignore traffic on this network as an
anti-spoofing measure.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="firewalld_loopback_traffic_trusted" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "firewalld" ; then
    yum install -y "firewalld"
fi

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
    firewall-offline-cmd --zone=trusted --add-interface=lo
elif systemctl is-active firewalld; then
    firewall-cmd --permanent --zone=trusted --add-interface=lo
    firewall-cmd --reload
else
    echo "
    firewalld service is not active. Remediation aborted!
    This remediation could not be applied because it depends on firewalld service running.
    The service is not started by this remediation in order to prevent connection issues."
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="firewalld_loopback_traffic_trusted" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Package is
    Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Collect Facts About System
    Services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Remediation is Applicable
    if firewalld Service is Running
  block:

  - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld trusted
      Zone Includes lo Interface
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-interface=lo
    register: result_lo_interface_assignment
    changed_when:
    - '''ALREADY_ENABLED'' not in result_lo_interface_assignment.stderr'

  - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Changes
      are Applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_lo_interface_assignment is changed
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.services['firewalld.service'].state == 'running'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Informative Message Based
    on Service State
  ansible.builtin.assert:
    that:
    - ansible_facts.services['firewalld.service'].state == 'running'
    fail_msg:
    - firewalld service is not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld service
      running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Configure Firewalld to Trust Loopback Traffic remediation successfully executed
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-firewalld_loopback_traffic_trusted:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-firewalld_loopback_traffic_trusted_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" severity="medium">
                <xccdf-1.2:title>Set Default firewalld Zone for Incoming Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default zone to <html:code>drop</html:code> for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
<html:code>/etc/firewalld/firewalld.conf</html:code> to be:
<html:pre>DefaultZone=drop</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1416</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>firewalld</html:code> the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to <html:code>drop</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_firewalld"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-set_firewalld_default_zone:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ipsec">
            <xccdf-1.2:title>IPSec Support</xccdf-1.2:title>
            <xccdf-1.2:description>Support for Internet Protocol Security (IPsec)
is provided with Libreswan.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libreswan_installed" severity="medium">
              <xccdf-1.2:title>Install libreswan Package</xccdf-1.2:title>
              <xccdf-1.2:description>The libreswan package provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. The <html:code>libreswan</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install libreswan</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000803</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000410</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271517r1091263_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Providing the ability for remote users or systems
to initiate a secure VPN connection protects information when it is
transmitted over a wide area network.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
if ! rpm -q --quiet "libreswan" ; then
    yum install -y "libreswan"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Ensure libreswan is installed
  package:
    name: libreswan
    state: present
  tags:
  - DISA-STIG-OL09-00-000410
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-4.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_libreswan_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_libreswan

class install_libreswan {
  package { 'libreswan':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libreswan_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=libreswan
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_libreswan_installed">
[[packages]]
name = "libreswan"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_libreswan_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_groupowner_etc_ipsecd" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/ipsec.d Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/ipsec.d</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/ipsec.d</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/ipsec.d directory by the root group is important
because this directory hosts Libreswan configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_groupowner_etc_ipsecd" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

find -H /etc/ipsec.d/ -maxdepth 1 -type d -exec chgrp -L root {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_groupowner_etc_ipsecd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_groupowner_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/ipsec.d/
  file:
    path: /etc/ipsec.d/
    state: directory
    group: root
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_groupowner_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_groupowner_etc_ipsecd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_groupowner_etc_ipsecd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_owner_etc_ipsecd" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/ipsec.d Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/ipsec.d</html:code>, run the command: <html:pre>$ sudo chown root /etc/ipsec.d </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/ipsec.d directory by the root user is important
because this directory hosts Libreswan configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_owner_etc_ipsecd" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

find -H /etc/ipsec.d/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_owner_etc_ipsecd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_owner_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/ipsec.d/
  file:
    path: /etc/ipsec.d/
    state: directory
    owner: '0'
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_owner_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_owner_etc_ipsecd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_owner_etc_ipsecd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_etc_ipsecd" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/ipsec.d Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/ipsec.d</html:code>, run the command: <html:pre>$ sudo chmod 0700 /etc/ipsec.d</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/ipsec.d directory is important
because this directory hosts Libreswan configuration. Protection of this
directory is critical for system security. Restricting the permissions
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_etc_ipsecd" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

find -H /etc/ipsec.d/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_permissions_etc_ipsecd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_permissions_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ipsec.d/ file(s)
  command: 'find -H /etc/ipsec.d/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/ipsec.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_ipsecd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_etc_ipsecd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_etc_ipsecd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_ipsec_conf" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/ipsec.conf File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/ipsec.conf</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/ipsec.conf</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/ipsec.conf file by the root group is important
because this file hosts Libreswan configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_ipsec_conf" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

chgrp root /etc/ipsec.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_ipsec_conf" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupowner_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ipsec.conf
  stat:
    path: /etc/ipsec.conf
  register: file_exists
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupowner_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner root on /etc/ipsec.conf
  file:
    path: /etc/ipsec.conf
    group: root
  when:
  - '"libreswan" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_ipsec_conf:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_ipsec_conf_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_ipsec_secrets" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/ipsec.secrets File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/ipsec.secrets</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/ipsec.secrets</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/ipsec.secrets file by the root group is important
because this file hosts Libreswan configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_ipsec_secrets" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

chgrp root /etc/ipsec.secrets

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_ipsec_secrets" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupowner_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ipsec.secrets
  stat:
    path: /etc/ipsec.secrets
  register: file_exists
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupowner_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner root on /etc/ipsec.secrets
  file:
    path: /etc/ipsec.secrets
    group: root
  when:
  - '"libreswan" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_ipsec_secrets:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_ipsec_secrets_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_ipsec_conf" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/ipsec.conf File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/ipsec.conf</html:code>, run the command: <html:pre>$ sudo chown root /etc/ipsec.conf </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/ipsec.conf file by the root user is important
because this file hosts Libreswan configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_ipsec_conf" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

chown 0 /etc/ipsec.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_ipsec_conf" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_owner_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ipsec.conf
  stat:
    path: /etc/ipsec.conf
  register: file_exists
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_owner_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/ipsec.conf
  file:
    path: /etc/ipsec.conf
    owner: '0'
  when:
  - '"libreswan" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_ipsec_conf:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_ipsec_conf_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_ipsec_secrets" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/ipsec.secrets File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/ipsec.secrets</html:code>, run the command: <html:pre>$ sudo chown root /etc/ipsec.secrets </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/ipsec.secrets file by the root user is important
because this file hosts Libreswan configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_ipsec_secrets" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

chown 0 /etc/ipsec.secrets

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_ipsec_secrets" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_owner_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ipsec.secrets
  stat:
    path: /etc/ipsec.secrets
  register: file_exists
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_owner_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/ipsec.secrets
  file:
    path: /etc/ipsec.secrets
    owner: '0'
  when:
  - '"libreswan" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_ipsec_secrets:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_ipsec_secrets_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_ipsec_conf" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/ipsec.conf File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/ipsec.conf</html:code>, run the command: <html:pre>$ sudo chmod 0644 /etc/ipsec.conf</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/ipsec.conf file is important
because this file hosts Libreswan configuration. Protection of this
file is critical for system security. Restricting the permissions
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_ipsec_conf" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

chmod u-xs,g-xws,o-xwt /etc/ipsec.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_ipsec_conf" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ipsec.conf
  stat:
    path: /etc/ipsec.conf
  register: file_exists
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/ipsec.conf
  file:
    path: /etc/ipsec.conf
    mode: u-xs,g-xws,o-xwt
  when:
  - '"libreswan" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_ipsec_conf:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_ipsec_conf_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_ipsec_secrets" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/ipsec.secrets File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/ipsec.secrets</html:code>, run the command: <html:pre>$ sudo chmod 0644 /etc/ipsec.secrets</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/ipsec.secrets file is important
because this file hosts Libreswan configuration. Protection of this
file is critical for system security. Restricting the permissions
ensures exclusive control of the Libreswan configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_libreswan"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_ipsec_secrets" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q libreswan; then

chmod u-xs,g-xws,o-xwt /etc/ipsec.secrets

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_ipsec_secrets" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ipsec.secrets
  stat:
    path: /etc/ipsec.secrets
  register: file_exists
  when: '"libreswan" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/ipsec.secrets
  file:
    path: /etc/ipsec.secrets
    mode: u-xs,g-xws,o-xwt
  when:
  - '"libreswan" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_ipsec_secrets
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_ipsec_secrets:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_ipsec_secrets_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" severity="medium">
              <xccdf-1.2:title>Verify Any Configured IPSec Tunnel Connections</xccdf-1.2:title>
              <xccdf-1.2:description>Libreswan provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. As such, IPsec can be used to circumvent certain
network requirements such as filtering. Verify that if any IPsec connection
(<html:code>conn</html:code>) configured in <html:code>/etc/ipsec.conf</html:code> and <html:code>/etc/ipsec.d</html:code>
exists is an approved organizational connection.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automatic remediation of this control is not available due to the unique
requirements of each system.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006010</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271863r1092639_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>IP tunneling mechanisms can be used to bypass network filtering.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-iptables">
            <xccdf-1.2:title>iptables and ip6tables</xccdf-1.2:title>
            <xccdf-1.2:description>A host-based firewall called <html:code>netfilter</html:code> is included as
part of the Linux kernel distributed with the system. It is
activated by default. This firewall is controlled by the program
<html:code>iptables</html:code>, and the entire capability is frequently referred to by
this name. An analogous program called <html:code>ip6tables</html:code> handles filtering
for IPv6.
<html:br/>
       <html:br/>
Unlike TCP Wrappers, which depends on the network server
program to support and respect the rules written, <html:code>netfilter</html:code>
filtering occurs at the kernel level, before a program can even
process the data from the network packet. As such, any program on
the system is affected by the rules written.
<html:br/>
       <html:br/>
This section provides basic information about strengthening
the <html:code>iptables</html:code> and <html:code>ip6tables</html:code> configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_groupowner_etc_iptables" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/iptables Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/iptables</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/iptables</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/iptables directory by the root group is important
because this directory hosts iptables configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the iptables configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_iptables"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_groupowner_etc_iptables" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q iptables; then

find -H /etc/iptables/ -maxdepth 1 -type d -exec chgrp -L root {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_groupowner_etc_iptables" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_groupowner_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/iptables/
  file:
    path: /etc/iptables/
    state: directory
    group: root
  when: '"iptables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_groupowner_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_groupowner_etc_iptables:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_groupowner_etc_iptables_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_owner_etc_iptables" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/iptables Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/iptables</html:code>, run the command: <html:pre>$ sudo chown root /etc/iptables </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/iptables directory by the root user is important
because this directory hosts iptables configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the iptables configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_iptables"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_owner_etc_iptables" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q iptables; then

find -H /etc/iptables/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_owner_etc_iptables" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_owner_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/iptables/
  file:
    path: /etc/iptables/
    state: directory
    owner: '0'
  when: '"iptables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_owner_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_owner_etc_iptables:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_owner_etc_iptables_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_etc_iptables" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/iptables Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/iptables</html:code>, run the command: <html:pre>$ sudo chmod 0700 /etc/iptables</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/iptables directory is important
because this directory hosts iptables configuration. Protection of this
directory is critical for system security. Restricting the permissions
ensures exclusive control of the iptables configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_iptables"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_etc_iptables" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q iptables; then

find -H /etc/iptables/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_permissions_etc_iptables" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_permissions_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/iptables/ file(s)
  command: 'find -H /etc/iptables/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"iptables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/iptables/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"iptables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_iptables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_etc_iptables:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_etc_iptables_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_activation">
              <xccdf-1.2:title>Inspect and Activate Default Rules</xccdf-1.2:title>
              <xccdf-1.2:description>View the currently-enforced <html:code>iptables</html:code> rules by running
the command:
<html:pre>$ sudo iptables -nL --line-numbers</html:pre>
The command is analogous for <html:code>ip6tables</html:code>.
<html:br/>
        <html:br/>
If the firewall does not appear to be active (i.e., no rules
appear), activate it and ensure that it starts at boot by issuing
the following commands (and analogously for <html:code>ip6tables</html:code>):
<html:pre>$ sudo service iptables restart</html:pre>
The default iptables rules are:
<html:pre>Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination</html:pre>
The <html:code>ip6tables</html:code> default rules are essentially the same.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_iptables_enabled" severity="medium">
                <xccdf-1.2:title>Verify iptables Enabled</xccdf-1.2:title>
                <xccdf-1.2:description>
The <html:code>iptables</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable iptables.service</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>iptables</html:code> service provides the system's host-based firewalling
capability for IPv4 and ICMP.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_iptables_and_service_disabled_firewalld_and_system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_iptables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q iptables &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'iptables.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'iptables.service'
fi
"$SYSTEMCTL_EXEC" enable 'iptables.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_iptables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_iptables_enabled

- name: Verify iptables Enabled - Enable service iptables
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Verify iptables Enabled - Enable Service iptables
    ansible.builtin.systemd:
      name: iptables
      enabled: true
      state: started
      masked: false
    when:
    - '"iptables" in ansible_facts.packages'
  when: ( "iptables" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_iptables_enabled
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_iptables_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_iptables

class enable_iptables {
  service {'iptables':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_iptables_enabled">
[customizations.services]
enabled = ["iptables"]
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_iptables_enabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule" severity="medium">
                <xccdf-1.2:title>Set Default ip6tables Policy for Incoming Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in

<html:code>/etc/sysconfig/ip6tables</html:code>:

<html:pre>:INPUT DROP [0:0]</html:pre>
If changes were required, reload the ip6tables rules:
<html:pre>$ sudo service ip6tables reload</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>ip6tables</html:code>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code>DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#not_package_nftables_and_not_package_ufw_and_package_iptables"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_ip6tables_default_rule"># Remediation is applicable only in certain platforms
if ( ! ( rpm --quiet -q nftables ) &amp;&amp; ! ( rpm --quiet -q ufw ) &amp;&amp; rpm --quiet -q iptables ); then

sed -i 's/^:INPUT ACCEPT.*/:INPUT DROP [0:0]/g' /etc/sysconfig/ip6tables

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications">
              <xccdf-1.2:title>Strengthen the Default Ruleset</xccdf-1.2:title>
              <xccdf-1.2:description>The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files <html:code>iptables</html:code> and <html:code>ip6tables</html:code> in the directory
<html:code>/etc/sysconfig</html:code>. Many of the lines in these files are similar
to the command line arguments that would be provided to the programs
<html:code>/sbin/iptables</html:code> or <html:code>/sbin/ip6tables</html:code> - but some are quite
different.
<html:br/>
        <html:br/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the iptables program to load in rules, and then invokes service
iptables save to write those loaded rules to
<html:code>/etc/sysconfig/iptables.</html:code>
        <html:br/>
        <html:br/>
The following alterations can be made directly to
<html:code>/etc/sysconfig/iptables</html:code> and <html:code>/etc/sysconfig/ip6tables</html:code>.
Instructions apply to both unless otherwise noted. Language and address
conventions for regular iptables are used throughout this section;
configuration for ip6tables will be either analogous or explicitly
covered.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The program <html:code>system-config-securitylevel</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts <html:code>/etc/sysconfig/iptables</html:code>. This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</xccdf-1.2:warning>
              <xccdf-1.2:platform idref="#package_iptables"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_iptables_default_rule" severity="medium">
                <xccdf-1.2:title>Set Default iptables Policy for Incoming Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
<html:code>/etc/sysconfig/iptables</html:code>:
<html:pre>:INPUT DROP [0:0]</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>iptables</html:code> the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code>DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#not_package_nftables_and_not_package_ufw"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_iptables_default_rule"># Remediation is applicable only in certain platforms
if rpm --quiet -q iptables &amp;&amp; { ( ! ( rpm --quiet -q nftables ) &amp;&amp; ! ( rpm --quiet -q ufw ) ); }; then

sed -i 's/^:INPUT ACCEPT.*/:INPUT DROP [0:0]/g' /etc/sysconfig/iptables

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward" severity="medium">
                <xccdf-1.2:title>Set Default iptables Policy for Forwarded Packets</xccdf-1.2:title>
                <xccdf-1.2:description>To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
<html:code>/etc/sysconfig/iptables</html:code>:
<html:pre>:FORWARD DROP [0:0]</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>In <html:code>iptables</html:code>, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to <html:code>DROP</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="set_iptables_default_rule_forward"># Remediation is applicable only in certain platforms
if rpm --quiet -q iptables; then

sed -i 's/^:FORWARD ACCEPT.*/:FORWARD DROP [0:0]/g' /etc/sysconfig/iptables

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ipv6">
            <xccdf-1.2:title>IPv6</xccdf-1.2:title>
            <xccdf-1.2:description>The system includes support for Internet Protocol
version 6. A major and often-mentioned improvement over IPv4 is its
enormous increase in the number of available addresses. Another
important feature is its support for automatic configuration of
many network settings.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_ipv6">
              <xccdf-1.2:title>Disable Support for IPv6 Unless Needed</xccdf-1.2:title>
              <xccdf-1.2:description>Despite configuration that suggests support for IPv6 has
been disabled, link-local IPv6 address auto-configuration occurs
even when only an IPv4 address is assigned. The only way to
effectively prevent execution of the IPv6 networking stack is to
instruct the system not to activate the IPv6 kernel module.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_ipv6_option_disabled" severity="medium">
                <xccdf-1.2:title>Disable IPv6 Networking Support Automatic Loading</xccdf-1.2:title>
                <xccdf-1.2:description>To prevent the IPv6 kernel module (<html:code>ipv6</html:code>) from binding to the
IPv6 networking stack, add the following line to
<html:code>/etc/modprobe.d/disabled.conf</html:code> (or another file in
<html:code>/etc/modprobe.d</html:code>):
<html:pre>options ipv6 disable=1</html:pre>
This permits the IPv6 module to be loaded (and thus satisfy other modules that
depend on it), while disabling support for the IPv6 protocol.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_ipv6_option_disabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack
echo "options ipv6 disable=1" &gt; /etc/modprobe.d/ipv6.conf

# Since according to: https://access.redhat.com/solutions/72733
# "ipv6 disable=1" options doesn't always disable the IPv6 networking stack from
# loading, instruct also sysctl configuration to disable IPv6 according to:
# https://access.redhat.com/solutions/8709#rhel6disable

declare -a IPV6_SETTINGS=("net.ipv6.conf.all.disable_ipv6" "net.ipv6.conf.default.disable_ipv6")

for setting in "${IPV6_SETTINGS[@]}"
do
	# Set runtime =1 for setting
	/sbin/sysctl -q -n -w "$setting=1"

	# If setting is present in /etc/sysctl.conf, change value to "1"
	# else, add "$setting = 1" to /etc/sysctl.conf
	if grep -q ^"$setting" /etc/sysctl.conf ; then
		sed -i "s/^$setting.*/$setting = 1/g" /etc/sysctl.conf
	else
		echo "" &gt;&gt; /etc/sysctl.conf
		echo "# Set $setting = 1 per security requirements" &gt;&gt; /etc/sysctl.conf
		echo "$setting = 1" &gt;&gt; /etc/sysctl.conf
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_ipv6_option_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_ipv6_option_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Disable IPv6 Networking kernel module
  lineinfile:
    create: true
    dest: /etc/modprobe.d/ipv6.conf
    regexp: ^options\s+ipv6\s+disable=\d
    line: options ipv6 disable=1
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_ipv6_option_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure disable_ipv6 (all and default) is set to 1
  sysctl:
    name: '{{ item }}'
    value: '1'
    state: present
    reload: true
  with_items:
  - net.ipv6.conf.all.disable_ipv6
  - net.ipv6.conf.default.disable_ipv6
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_ipv6_option_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_ipv6_option_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_disable_ipv6" severity="medium">
                <xccdf-1.2:title>Disable IPv6 Addressing on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To disable support for (<html:code>ipv6</html:code>) addressing on all interface add the following line to
<html:code>/etc/sysctl.d/ipv6.conf</html:code> (or another file in <html:code>/etc/sysctl.d</html:code>):
<html:pre>net.ipv6.conf.all.disable_ipv6 = 1</html:pre>
This disables IPv6 on all network interfaces as other services and system
functionality require the IPv6 stack loaded to work.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.disable_ipv6 from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.disable_ipv6.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.disable_ipv6" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv6.conf.all.disable_ipv6
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.disable_ipv6="1"
fi

#
# If net.ipv6.conf.all.disable_ipv6 present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv6.conf.all.disable_ipv6 = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.disable_ipv6")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.disable_ipv6\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.disable_ipv6\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_disable_ipv6

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.disable_ipv6.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_disable_ipv6

- name: Comment out any occurrences of net.ipv6.conf.all.disable_ipv6 from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.disable_ipv6
    replace: '#net.ipv6.conf.all.disable_ipv6'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_disable_ipv6

- name: Ensure sysctl net.ipv6.conf.all.disable_ipv6 is set to 1
  sysctl:
    name: net.ipv6.conf.all.disable_ipv6
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_disable_ipv6
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_disable_ipv6" severity="medium">
                <xccdf-1.2:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To disable support for (<html:code>ipv6</html:code>) addressing on interfaces by default add the following line to
<html:code>/etc/sysctl.d/ipv6.conf</html:code> (or another file in <html:code>/etc/sysctl.d</html:code>):
<html:pre>net.ipv6.conf.default.disable_ipv6 = 1</html:pre>
This disables IPv6 on network interfaces by default as other services and system
functionality require the IPv6 stack loaded to work.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.disable_ipv6 from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.disable_ipv6.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.disable_ipv6" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv6.conf.default.disable_ipv6
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.disable_ipv6="1"
fi

#
# If net.ipv6.conf.default.disable_ipv6 present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv6.conf.default.disable_ipv6 = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.disable_ipv6")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.disable_ipv6\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.disable_ipv6\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_disable_ipv6" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_disable_ipv6

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.disable_ipv6.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_disable_ipv6

- name: Comment out any occurrences of net.ipv6.conf.default.disable_ipv6 from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.disable_ipv6
    replace: '#net.ipv6.conf.default.disable_ipv6'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_disable_ipv6

- name: Ensure sysctl net.ipv6.conf.default.disable_ipv6 is set to 1
  sysctl:
    name: net.ipv6.conf.default.disable_ipv6
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_disable_ipv6
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configuring_ipv6">
              <xccdf-1.2:title>Configure IPv6 Settings if Necessary</xccdf-1.2:title>
              <xccdf-1.2:description>A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#ipv6_enabled"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra_defrtr</xccdf-1.2:title>
                <xccdf-1.2:description>Accept default router in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra_pinfo</xccdf-1.2:title>
                <xccdf-1.2:description>Accept prefix information in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra_rtr_pref</xccdf-1.2:title>
                <xccdf-1.2:description>Accept router preference in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_ra</xccdf-1.2:title>
                <xccdf-1.2:description>Accept all router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle ICMP Redirect Acceptance</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.autoconf</xccdf-1.2:title>
                <xccdf-1.2:description>Enable auto configuration on IPv6 interfaces</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.forwarding</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle IPv6 Forwarding</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.max_addresses</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum number of autoconfigured IPv6 addresses</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.all.router_solicitations</xccdf-1.2:title>
                <xccdf-1.2:description>Accept all router solicitations?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra_defrtr</xccdf-1.2:title>
                <xccdf-1.2:description>Accept default router in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra_pinfo</xccdf-1.2:title>
                <xccdf-1.2:description>Accept prefix information in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra_rtr_pref</xccdf-1.2:title>
                <xccdf-1.2:description>Accept router preference in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_ra</xccdf-1.2:title>
                <xccdf-1.2:description>Accept default router advertisements by default?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle ICMP Redirect Acceptance By Default</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.autoconf</xccdf-1.2:title>
                <xccdf-1.2:description>Enable auto configuration on IPv6 interfaces</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.max_addresses</xccdf-1.2:title>
                <xccdf-1.2:description>Maximum number of autoconfigured IPv6 addresses</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" type="number">
                <xccdf-1.2:title>net.ipv6.conf.default.router_solicitations</xccdf-1.2:title>
                <xccdf-1.2:description>Accept all router solicitations by default?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" severity="medium">
                <xccdf-1.2:title>Configure Accepting Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006040</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271877r1092343_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_ra" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_ra_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra="$sysctl_net_ipv6_conf_all_accept_ra_value"
fi

#
# If net.ipv6.conf.all.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_ra\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006040
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006040
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra
    replace: '#net.ipv6.conf.all.accept_ra'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006040
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006040
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_defrtr" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra_defrtr</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra_defrtr=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra_defrtr = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra_defrtr from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra_defrtr.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_ra_defrtr" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_ra_defrtr_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra_defrtr
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_defrtr="$sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"
fi

#
# If net.ipv6.conf.all.accept_ra_defrtr present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_defrtr = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra_defrtr")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra_defrtr\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_ra_defrtr\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_defrtr
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra_defrtr.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_defrtr
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra_defrtr from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra_defrtr
    replace: '#net.ipv6.conf.all.accept_ra_defrtr'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_defrtr
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_defrtr_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_defrtr_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_defrtr is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_defrtr
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_defrtr_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_defrtr
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_pinfo" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra_pinfo</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra_pinfo = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra_pinfo from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra_pinfo.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_ra_pinfo" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_ra_pinfo_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra_pinfo
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_pinfo="$sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"
fi

#
# If net.ipv6.conf.all.accept_ra_pinfo present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_pinfo = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra_pinfo")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra_pinfo\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_ra_pinfo\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_pinfo
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra_pinfo.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_pinfo
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra_pinfo from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra_pinfo
    replace: '#net.ipv6.conf.all.accept_ra_pinfo'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_pinfo
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_pinfo_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_pinfo_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_pinfo is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_pinfo
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_pinfo_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_pinfo
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_ra_rtr_pref</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_ra_rtr_pref=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_ra_rtr_pref = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra_rtr_pref from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra_rtr_pref.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_ra_rtr_pref" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra_rtr_pref
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra_rtr_pref="$sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"
fi

#
# If net.ipv6.conf.all.accept_ra_rtr_pref present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra_rtr_pref = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra_rtr_pref")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra_rtr_pref\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_ra_rtr_pref\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.accept_ra_rtr_pref from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref
    replace: '#net.ipv6.conf.all.accept_ra_rtr_pref'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra_rtr_pref is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra_rtr_pref
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra_rtr_pref
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Accepting ICMP Redirects for All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271878r1092346_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit ICMP redirect message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_redirects="$sysctl_net_ipv6_conf_all_accept_redirects_value"
fi

#
# If net.ipv6.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006041
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006041
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects

- name: Comment out any occurrences of net.ipv6.conf.all.accept_redirects from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_redirects
    replace: '#net.ipv6.conf.all.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006041
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_redirects is set
  sysctl:
    name: net.ipv6.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_all_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006041
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.accept_source_route</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.accept_source_route = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006042</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271879r1092349_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
<html:br/>
         <html:br/>
Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_source_route_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_source_route
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_source_route="$sysctl_net_ipv6_conf_all_accept_source_route_value"
fi

#
# If net.ipv6.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006042
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.accept_source_route.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006042
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route

- name: Comment out any occurrences of net.ipv6.conf.all.accept_source_route from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_source_route
    replace: '#net.ipv6.conf.all.accept_source_route'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006042
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_source_route_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_source_route is set
  sysctl:
    name: net.ipv6.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv6_conf_all_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006042
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_autoconf" severity="unknown">
                <xccdf-1.2:title>Configure Auto Configuration on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.autoconf</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.autoconf=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.autoconf = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.autoconf from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.autoconf.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.autoconf" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_autoconf_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.autoconf
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.autoconf="$sysctl_net_ipv6_conf_all_autoconf_value"
fi

#
# If net.ipv6.conf.all.autoconf present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.autoconf = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.autoconf")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_autoconf_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.autoconf\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.autoconf\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_autoconf
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.autoconf.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_autoconf
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.autoconf from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.autoconf
    replace: '#net.ipv6.conf.all.autoconf'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_autoconf
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_autoconf_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_autoconf_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.autoconf is set
  sysctl:
    name: net.ipv6.conf.all.autoconf
    value: '{{ sysctl_net_ipv6_conf_all_autoconf_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_autoconf
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for IPv6 Forwarding</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.forwarding</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.forwarding=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.forwarding = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006043</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271880r1092352_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_forwarding" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.forwarding from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.forwarding.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.forwarding" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_forwarding_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.forwarding
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.forwarding="$sysctl_net_ipv6_conf_all_forwarding_value"
fi

#
# If net.ipv6.conf.all.forwarding present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.forwarding = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.forwarding")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_forwarding_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.forwarding\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.forwarding\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_forwarding" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006043
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.forwarding.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006043
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding

- name: Comment out any occurrences of net.ipv6.conf.all.forwarding from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.forwarding
    replace: '#net.ipv6.conf.all.forwarding'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006043
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding
- name: XCCDF Value sysctl_net_ipv6_conf_all_forwarding_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_forwarding_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.forwarding is set
  sysctl:
    name: net.ipv6.conf.all.forwarding
    value: '{{ sysctl_net_ipv6_conf_all_forwarding_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006043
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_max_addresses" severity="unknown">
                <xccdf-1.2:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.max_addresses</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.max_addresses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.max_addresses = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.max_addresses from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.max_addresses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.max_addresses" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_max_addresses_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.max_addresses
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.max_addresses="$sysctl_net_ipv6_conf_all_max_addresses_value"
fi

#
# If net.ipv6.conf.all.max_addresses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.max_addresses = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.max_addresses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_max_addresses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.max_addresses\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.max_addresses\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_max_addresses
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.max_addresses.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_max_addresses
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.max_addresses from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.max_addresses
    replace: '#net.ipv6.conf.all.max_addresses'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_max_addresses
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_max_addresses_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_max_addresses_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.max_addresses is set
  sysctl:
    name: net.ipv6.conf.all.max_addresses
    value: '{{ sysctl_net_ipv6_conf_all_max_addresses_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_max_addresses
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_router_solicitations" severity="unknown">
                <xccdf-1.2:title>Configure Denying Router Solicitations on All IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.all.router_solicitations</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.all.router_solicitations=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.all.router_solicitations = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>To prevent discovery of the system by other systems, router solicitation requests should be denied.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_all_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.all.router_solicitations from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.router_solicitations.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.router_solicitations" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_router_solicitations_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.router_solicitations
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.router_solicitations="$sysctl_net_ipv6_conf_all_router_solicitations_value"
fi

#
# If net.ipv6.conf.all.router_solicitations present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.router_solicitations = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.router_solicitations")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_router_solicitations_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.router_solicitations\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.router_solicitations\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_all_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_router_solicitations
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.all.router_solicitations.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_router_solicitations
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.all.router_solicitations from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.all.router_solicitations
    replace: '#net.ipv6.conf.all.router_solicitations'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_router_solicitations
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_all_router_solicitations_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_router_solicitations_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.router_solicitations is set
  sysctl:
    name: net.ipv6.conf.all.router_solicitations
    value: '{{ sysctl_net_ipv6_conf_all_router_solicitations_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_all_router_solicitations
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" severity="medium">
                <xccdf-1.2:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271881r1092355_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_ra" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_ra_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra="$sysctl_net_ipv6_conf_default_accept_ra_value"
fi

#
# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_ra\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006044
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006044
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra
    replace: '#net.ipv6.conf.default.accept_ra'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006044
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006044
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_defrtr" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra_defrtr</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra_defrtr = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra_defrtr from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra_defrtr.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_ra_defrtr" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_ra_defrtr_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra_defrtr
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_defrtr="$sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"
fi

#
# If net.ipv6.conf.default.accept_ra_defrtr present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_defrtr = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra_defrtr")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra_defrtr\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_ra_defrtr\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_defrtr
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra_defrtr.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_defrtr
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra_defrtr from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra_defrtr
    replace: '#net.ipv6.conf.default.accept_ra_defrtr'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_defrtr
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_defrtr_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_defrtr_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_defrtr is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_defrtr
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_defrtr_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_defrtr
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_pinfo" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra_pinfo</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra_pinfo = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra_pinfo from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra_pinfo.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_ra_pinfo" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_ra_pinfo_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra_pinfo
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_pinfo="$sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"
fi

#
# If net.ipv6.conf.default.accept_ra_pinfo present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_pinfo = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra_pinfo")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra_pinfo\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_ra_pinfo\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_pinfo
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra_pinfo.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_pinfo
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra_pinfo from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra_pinfo
    replace: '#net.ipv6.conf.default.accept_ra_pinfo'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_pinfo
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_pinfo_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_pinfo_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_pinfo is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_pinfo
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_pinfo_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_pinfo
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" severity="unknown">
                <xccdf-1.2:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_ra_rtr_pref</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_ra_rtr_pref = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra_rtr_pref from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra_rtr_pref.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_ra_rtr_pref" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra_rtr_pref
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra_rtr_pref="$sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"
fi

#
# If net.ipv6.conf.default.accept_ra_rtr_pref present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra_rtr_pref = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra_rtr_pref")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra_rtr_pref\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_ra_rtr_pref\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.accept_ra_rtr_pref from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref
    replace: '#net.ipv6.conf.default.accept_ra_rtr_pref'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra_rtr_pref is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra_rtr_pref
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra_rtr_pref
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271882r1092358_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit ICMP redirect message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_redirects="$sysctl_net_ipv6_conf_default_accept_redirects_value"
fi

#
# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006045
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006045
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects

- name: Comment out any occurrences of net.ipv6.conf.default.accept_redirects from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
    replace: '#net.ipv6.conf.default.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006045
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv6.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006045
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.accept_source_route</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.accept_source_route = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006046</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271883r1092361_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.

Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_source_route_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_source_route
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_source_route="$sysctl_net_ipv6_conf_default_accept_source_route_value"
fi

#
# If net.ipv6.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006046
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.accept_source_route.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006046
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route

- name: Comment out any occurrences of net.ipv6.conf.default.accept_source_route from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_source_route
    replace: '#net.ipv6.conf.default.accept_source_route'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006046
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_source_route_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_source_route is set
  sysctl:
    name: net.ipv6.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv6_conf_default_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006046
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_autoconf" severity="unknown">
                <xccdf-1.2:title>Configure Auto Configuration on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.autoconf</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.autoconf=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.autoconf = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>An illicit router advertisement message could result in a man-in-the-middle attack.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.autoconf from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.autoconf.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.autoconf" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_autoconf_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.autoconf
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.autoconf="$sysctl_net_ipv6_conf_default_autoconf_value"
fi

#
# If net.ipv6.conf.default.autoconf present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.autoconf = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.autoconf")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_autoconf_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.autoconf\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.autoconf\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_autoconf" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_autoconf
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.autoconf.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_autoconf
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.autoconf from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.autoconf
    replace: '#net.ipv6.conf.default.autoconf'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_autoconf
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_autoconf_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_autoconf_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.autoconf is set
  sysctl:
    name: net.ipv6.conf.default.autoconf
    value: '{{ sysctl_net_ipv6_conf_default_autoconf_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_autoconf
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_max_addresses" severity="unknown">
                <xccdf-1.2:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.max_addresses</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.max_addresses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.max_addresses = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The number of global unicast IPv6 addresses for each interface should be limited exactly to the number of statically configured addresses.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.max_addresses from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.max_addresses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.max_addresses" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_max_addresses_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.max_addresses
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.max_addresses="$sysctl_net_ipv6_conf_default_max_addresses_value"
fi

#
# If net.ipv6.conf.default.max_addresses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.max_addresses = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.max_addresses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_max_addresses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.max_addresses\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.max_addresses\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_max_addresses" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_max_addresses
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.max_addresses.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_max_addresses
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.max_addresses from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.max_addresses
    replace: '#net.ipv6.conf.default.max_addresses'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_max_addresses
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_max_addresses_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_max_addresses_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.max_addresses is set
  sysctl:
    name: net.ipv6.conf.default.max_addresses
    value: '{{ sysctl_net_ipv6_conf_default_max_addresses_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_max_addresses
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_router_solicitations" severity="unknown">
                <xccdf-1.2:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv6.conf.default.router_solicitations</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv6.conf.default.router_solicitations=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv6.conf.default.router_solicitations = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</xccdf-1.2:reference>
                <xccdf-1.2:rationale>To prevent discovery of the system by other systems, router solicitation requests should be denied.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv6_conf_default_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv6.conf.default.router_solicitations from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.router_solicitations.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.router_solicitations" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_router_solicitations_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.router_solicitations
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.router_solicitations="$sysctl_net_ipv6_conf_default_router_solicitations_value"
fi

#
# If net.ipv6.conf.default.router_solicitations present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.router_solicitations = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.router_solicitations")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_router_solicitations_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.router_solicitations\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.router_solicitations\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv6_conf_default_router_solicitations" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_router_solicitations
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv6.conf.default.router_solicitations.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_router_solicitations
  - unknown_severity

- name: Comment out any occurrences of net.ipv6.conf.default.router_solicitations
    from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv6.conf.default.router_solicitations
    replace: '#net.ipv6.conf.default.router_solicitations'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_router_solicitations
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv6_conf_default_router_solicitations_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_router_solicitations_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.router_solicitations is set
  sysctl:
    name: net.ipv6.conf.default.router_solicitations
    value: '{{ sysctl_net_ipv6_conf_default_router_solicitations_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv6_conf_default_router_solicitations
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-kernel">
            <xccdf-1.2:title>Kernel Parameters Which Affect Networking</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>sysctl</html:code> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_host_and_router_parameters">
              <xccdf-1.2:title>Network Related Kernel Runtime Parameters for Hosts and Routers</xccdf-1.2:title>
              <xccdf-1.2:description>Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Disable ICMP Redirect Acceptance</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.arp_filter</xccdf-1.2:title>
                <xccdf-1.2:description>Controls whether the ARP filter is enabled or not.

1 - Allows you to have multiple network interfaces on the same subnet, and have the ARPs for each
interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that interface.
In other words it allows control of which cards (usually 1) will respond to an ARP request.

0 - (default) The kernel can respond to arp requests with addresses from other interfaces.
This may seem wrong but it usually makes sense, because it increases the chance of successful communication.
IP addresses are owned by the complete host on Linux, not by particular interfaces.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.arp_ignore</xccdf-1.2:title>
                <xccdf-1.2:description>Control the response modes for ARP queries that resolve local target IP addresses:

0 - (default): reply for any local target IP address, configured on any interface
1 - reply only if the target IP address is local address configured on the incoming interface
2 - reply only if the target IP address is local address configured on the incoming interface and both with the sender’s IP address are part from same subnet on this interface
3 - do not reply for local addresses configured with scope host, only resolutions for global and link addresses are replied
4-7 - reserved
8 - do not reply for all local addresses</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_forwarding_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.forwarding</xccdf-1.2:title>
                <xccdf-1.2:description>Toggle IPv4 Forwarding</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.log_martians</xccdf-1.2:title>
                <xccdf-1.2:description>Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.rp_filter</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="loose">2</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.secure_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packets on all interfaces.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.all.shared_media</xccdf-1.2:title>
                <xccdf-1.2:description>Controls whether the system can send (router) or accept (host) RFC1620 shared media redirects.
<html:code>shared_media</html:code> for the interface will be enabled if at least one of conf/{all,interface}/shared_media
is set to TRUE, it will be disabled otherwise.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Disable ICMP Redirect Acceptance?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description>Disable IP source routing?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.log_martians</xccdf-1.2:title>
                <xccdf-1.2:description>Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.rp_filter</xccdf-1.2:title>
                <xccdf-1.2:description>Enables source route verification</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.secure_redirects</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packages by default.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" type="number">
                <xccdf-1.2:title>net.ipv4.conf.default.shared_media</xccdf-1.2:title>
                <xccdf-1.2:description>Controls whether the system can send(router) or accept(host) RFC1620 shared media redirects.
<html:code>shared_media</html:code> for the interface will be enabled if at least one of conf/{all,interface}/shared_media
is set to TRUE, it will be disabled otherwise.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="number">
                <xccdf-1.2:title>net.ipv4.icmp_echo_ignore_broadcasts</xccdf-1.2:title>
                <xccdf-1.2:description>Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="number">
                <xccdf-1.2:title>net.ipv4.icmp_ignore_bogus_error_responses</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to prevent unnecessary logging</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value" type="number">
                <xccdf-1.2:title>net.ipv4.tcp_rfc1337</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to enable TCP behavior conformant with RFC 1337</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" type="number">
                <xccdf-1.2:title>net.ipv4.tcp_syncookies</xccdf-1.2:title>
                <xccdf-1.2:description>Enable to turn on TCP SYN Cookie
Protection</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_local" severity="medium">
                <xccdf-1.2:title>Disable Accepting Packets Routed Between Local Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.accept_local</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.accept_local=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.accept_local = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Configure <html:code>net.ipv4.conf.all.accept_local=0</html:code> to consider as invalid the packets
received from outside whose source is the 127.0.0.0/8 address block.
In combination with suitable routing, this can be used to direct packets between two
local interfaces over the wire and have them accepted properly.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_accept_local" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.accept_local from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_local.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.accept_local" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.all.accept_local
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_local="0"
fi

#
# If net.ipv4.conf.all.accept_local present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.accept_local = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_local")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_local\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.accept_local\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_accept_local" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_local

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.accept_local.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_local

- name: Comment out any occurrences of net.ipv4.conf.all.accept_local from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_local
    replace: '#net.ipv4.conf.all.accept_local'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_local

- name: Ensure sysctl net.ipv4.conf.all.accept_local is set to 0
  sysctl:
    name: net.ipv4.conf.all.accept_local
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_local
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_accept_local:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.accept_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271864r1092304_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br/>
This feature of the IPv4 protocol has few legitimate uses. It should be
disabled unless absolutely required."</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.accept_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_redirects="$sysctl_net_ipv4_conf_all_accept_redirects_value"
fi

#
# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006020
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006020
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects

- name: Comment out any occurrences of net.ipv4.conf.all.accept_redirects from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
    replace: '#net.ipv4.conf.all.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006020
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.accept_redirects is set
  sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006020
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.accept_source_route</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.accept_source_route = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006021</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271865r1092307_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
<html:br/>
         <html:br/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_accept_source_route_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.accept_source_route
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_source_route="$sysctl_net_ipv4_conf_all_accept_source_route_value"
fi

#
# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006021
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.accept_source_route.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006021
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route

- name: Comment out any occurrences of net.ipv4.conf.all.accept_source_route from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_source_route
    replace: '#net.ipv4.conf.all.accept_source_route'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006021
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route
- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_source_route_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.accept_source_route is set
  sysctl:
    name: net.ipv4.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_all_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006021
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter" severity="medium">
                <xccdf-1.2:title>Configure ARP filtering for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.arp_filter</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.arp_filter=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/>
         </html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.arp_filter = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">This behaviour may cause problems to system on a high availability or load balancing configuration.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Prevents the Linux Kernel from handling the ARP table globally.
By default, the kernel may respond to an ARP request from a certain interface with information
from another interface.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_arp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.arp_filter from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.arp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.arp_filter" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_arp_filter_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.arp_filter
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.arp_filter="$sysctl_net_ipv4_conf_all_arp_filter_value"
fi

#
# If net.ipv4.conf.all.arp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.arp_filter = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.arp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_arp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.arp_filter\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.arp_filter\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_arp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_filter

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.arp_filter.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_filter

- name: Comment out any occurrences of net.ipv4.conf.all.arp_filter from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.arp_filter
    replace: '#net.ipv4.conf.all.arp_filter'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_all_arp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_arp_filter_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.arp_filter is set
  sysctl:
    name: net.ipv4.conf.all.arp_filter
    value: '{{ sysctl_net_ipv4_conf_all_arp_filter_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_filter
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_filter_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_ignore" severity="medium">
                <xccdf-1.2:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.arp_ignore</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.arp_ignore=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/>
         </html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.arp_ignore = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">The ARP response mode may impact behaviour of workloads and firewalls on the system.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Avoids ARP Flux on system that have more than one interface on the same subnet.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_arp_ignore" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.arp_ignore from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.arp_ignore.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.arp_ignore" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_arp_ignore_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.arp_ignore
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.arp_ignore="$sysctl_net_ipv4_conf_all_arp_ignore_value"
fi

#
# If net.ipv4.conf.all.arp_ignore present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.arp_ignore = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.arp_ignore")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_arp_ignore_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.arp_ignore\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.arp_ignore\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_arp_ignore" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_ignore

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.arp_ignore.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_ignore

- name: Comment out any occurrences of net.ipv4.conf.all.arp_ignore from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.arp_ignore
    replace: '#net.ipv4.conf.all.arp_ignore'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_ignore
- name: XCCDF Value sysctl_net_ipv4_conf_all_arp_ignore_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_arp_ignore_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.arp_ignore is set
  sysctl:
    name: net.ipv4.conf.all.arp_ignore
    value: '{{ sysctl_net_ipv4_conf_all_arp_ignore_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_arp_ignore
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_arp_ignore_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_drop_gratuitous_arp" severity="medium">
                <xccdf-1.2:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.drop_gratuitous_arp</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.drop_gratuitous_arp=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.drop_gratuitous_arp = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">This can cause problems if ARP proxies are used in the network.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Drop Gratuitous ARP frames to prevent ARP poisoning.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.drop_gratuitous_arp from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.drop_gratuitous_arp.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.drop_gratuitous_arp" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.all.drop_gratuitous_arp
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.drop_gratuitous_arp="1"
fi

#
# If net.ipv4.conf.all.drop_gratuitous_arp present in /etc/sysctl.conf, change value to "1"
#	else, add "net.ipv4.conf.all.drop_gratuitous_arp = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.drop_gratuitous_arp")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.drop_gratuitous_arp\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.drop_gratuitous_arp\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_drop_gratuitous_arp

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.drop_gratuitous_arp.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_drop_gratuitous_arp

- name: Comment out any occurrences of net.ipv4.conf.all.drop_gratuitous_arp from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.drop_gratuitous_arp
    replace: '#net.ipv4.conf.all.drop_gratuitous_arp'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_drop_gratuitous_arp

- name: Ensure sysctl net.ipv4.conf.all.drop_gratuitous_arp is set to 1
  sysctl:
    name: net.ipv4.conf.all.drop_gratuitous_arp
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_drop_gratuitous_arp
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_forwarding" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.forwarding</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.forwarding=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.forwarding = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="general">There might be cases when certain applications can systematically override this option.
One such case is <html:a href="https://libvirt.org/">Libvirt</html:a>; a toolkit for managing of virtualization platforms.
By default, Libvirt requires IP forwarding to be enabled to facilitate
network communication between the virtualization host and guest
machines. It enables IP forwarding after every reboot.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006028</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271872r1092328_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_forwarding" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.forwarding from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.forwarding.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.forwarding" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_forwarding_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_forwarding_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.forwarding
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.forwarding="$sysctl_net_ipv4_conf_all_forwarding_value"
fi

#
# If net.ipv4.conf.all.forwarding present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.forwarding = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.forwarding")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_forwarding_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.forwarding\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.forwarding\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_forwarding" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006028
  - NIST-800-53-CM-6(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_forwarding

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.forwarding.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006028
  - NIST-800-53-CM-6(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_forwarding

- name: Comment out any occurrences of net.ipv4.conf.all.forwarding from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.forwarding
    replace: '#net.ipv4.conf.all.forwarding'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006028
  - NIST-800-53-CM-6(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_forwarding
- name: XCCDF Value sysctl_net_ipv4_conf_all_forwarding_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_forwarding_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_forwarding_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.forwarding is set
  sysctl:
    name: net.ipv4.conf.all.forwarding
    value: '{{ sysctl_net_ipv4_conf_all_forwarding_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006028
  - NIST-800-53-CM-6(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_forwarding
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_forwarding_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_forwarding:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_forwarding_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" severity="unknown">
                <xccdf-1.2:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.log_martians</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.log_martians = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006022</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271866r1092310_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.log_martians from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.log_martians.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.log_martians" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_log_martians_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.log_martians
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.log_martians="$sysctl_net_ipv4_conf_all_log_martians_value"
fi

#
# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.log_martians = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.log_martians")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_log_martians_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.log_martians\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.log_martians\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006022
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.log_martians.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006022
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity

- name: Comment out any occurrences of net.ipv4.conf.all.log_martians from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.log_martians
    replace: '#net.ipv4.conf.all.log_martians'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006022
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_conf_all_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_log_martians_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.log_martians is set
  sysctl:
    name: net.ipv4.conf.all.log_martians
    value: '{{ sysctl_net_ipv4_conf_all_log_martians_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006022
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_route_localnet" severity="medium">
                <xccdf-1.2:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.route_localnet</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.route_localnet=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.route_localnet = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Refuse the routing of packets whose source or destination address is the local loopback.
This prohibits the use of network 127/8 for local routing purposes.
Enabling <html:code>route_localnet</html:code> can expose applications listening on localhost to external traffic.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_route_localnet" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.route_localnet from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.route_localnet.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.route_localnet" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.all.route_localnet
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.route_localnet="0"
fi

#
# If net.ipv4.conf.all.route_localnet present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.route_localnet = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.route_localnet")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.route_localnet\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.route_localnet\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_route_localnet" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_route_localnet

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.route_localnet.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_route_localnet

- name: Comment out any occurrences of net.ipv4.conf.all.route_localnet from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.route_localnet
    replace: '#net.ipv4.conf.all.route_localnet'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_route_localnet

- name: Ensure sysctl net.ipv4.conf.all.route_localnet is set to 0
  sysctl:
    name: net.ipv4.conf.all.route_localnet
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_route_localnet
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.rp_filter</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.rp_filter = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006024</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271868r1092316_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.rp_filter from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.rp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.rp_filter" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_rp_filter_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.rp_filter
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.rp_filter="$sysctl_net_ipv4_conf_all_rp_filter_value"
fi

#
# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.rp_filter = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.rp_filter\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.rp_filter\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006024
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.rp_filter.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006024
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter

- name: Comment out any occurrences of net.ipv4.conf.all.rp_filter from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.rp_filter
    replace: '#net.ipv4.conf.all.rp_filter'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006024
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_all_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_rp_filter_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.rp_filter is set
  sysctl:
    name: net.ipv4.conf.all.rp_filter
    value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006024
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.secure_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.secure_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001503</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.secure_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.secure_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.secure_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_secure_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.secure_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.secure_redirects="$sysctl_net_ipv4_conf_all_secure_redirects_value"
fi

#
# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.secure_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.secure_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.secure_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.secure_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects

- name: Comment out any occurrences of net.ipv4.conf.all.secure_redirects from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.secure_redirects
    replace: '#net.ipv4.conf.all.secure_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_all_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_secure_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_shared_media" severity="medium">
                <xccdf-1.2:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.shared_media</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.shared_media=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/>
         </html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.shared_media = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>This setting should be aligned with <html:code>net.ipv4.conf.all.secure_redirects</html:code> because it overrides it.
If <html:code>shared_media</html:code> is enabled for an interface <html:code>secure_redirects</html:code> will be enabled too.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.shared_media from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.shared_media.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.shared_media" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_shared_media_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.shared_media
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.shared_media="$sysctl_net_ipv4_conf_all_shared_media_value"
fi

#
# If net.ipv4.conf.all.shared_media present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.shared_media = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.shared_media")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_shared_media_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.shared_media\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.shared_media\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_shared_media

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.shared_media.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_shared_media

- name: Comment out any occurrences of net.ipv4.conf.all.shared_media from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.shared_media
    replace: '#net.ipv4.conf.all.shared_media'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_shared_media
- name: XCCDF Value sysctl_net_ipv4_conf_all_shared_media_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_shared_media_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.shared_media is set
  sysctl:
    name: net.ipv4.conf.all.shared_media
    value: '{{ sysctl_net_ipv4_conf_all_shared_media_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_shared_media
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_shared_media_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_shared_media:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.accept_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006025</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271869r1092319_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br/>This feature of the IPv4 protocol has few legitimate uses. It should
be disabled unless absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_accept_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.accept_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.accept_redirects="$sysctl_net_ipv4_conf_default_accept_redirects_value"
fi

#
# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_accept_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006025
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.accept_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006025
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects

- name: Comment out any occurrences of net.ipv4.conf.default.accept_redirects from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
    replace: '#net.ipv4.conf.default.accept_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006025
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv4.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006025
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.accept_source_route</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.accept_source_route = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006026</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271870r1092322_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
<html:br/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required, such as when
IPv4 forwarding is enabled and the system is legitimately functioning as a
router.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_accept_source_route_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.accept_source_route
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.accept_source_route="$sysctl_net_ipv4_conf_default_accept_source_route_value"
fi

#
# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_accept_source_route" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006026
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.accept_source_route.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006026
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route

- name: Comment out any occurrences of net.ipv4.conf.default.accept_source_route from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.accept_source_route
    replace: '#net.ipv4.conf.default.accept_source_route'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006026
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route
- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_source_route_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.accept_source_route is set
  sysctl:
    name: net.ipv4.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_default_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006026
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" severity="unknown">
                <xccdf-1.2:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.log_martians</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.log_martians = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006023</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271867r1092313_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.log_martians from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.log_martians.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.log_martians" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_log_martians_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.log_martians
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.log_martians="$sysctl_net_ipv4_conf_default_log_martians_value"
fi

#
# If net.ipv4.conf.default.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.log_martians = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.log_martians")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_log_martians_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.log_martians\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.log_martians\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_log_martians" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006023
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.log_martians.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006023
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity

- name: Comment out any occurrences of net.ipv4.conf.default.log_martians from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.log_martians
    replace: '#net.ipv4.conf.default.log_martians'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006023
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_conf_default_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_log_martians_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.log_martians is set
  sysctl:
    name: net.ipv4.conf.default.log_martians
    value: '{{ sysctl_net_ipv4_conf_default_log_martians_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006023
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.rp_filter</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.rp_filter = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006027</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271871r1092325_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.rp_filter from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.rp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.rp_filter" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_rp_filter_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.rp_filter
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.rp_filter="$sysctl_net_ipv4_conf_default_rp_filter_value"
fi

#
# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.rp_filter = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.rp_filter\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.rp_filter\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_rp_filter" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006027
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.rp_filter.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006027
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter

- name: Comment out any occurrences of net.ipv4.conf.default.rp_filter from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.rp_filter
    replace: '#net.ipv4.conf.default.rp_filter'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006027
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_default_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_rp_filter_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.rp_filter is set
  sysctl:
    name: net.ipv4.conf.default.rp_filter
    value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006027
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" severity="medium">
                <xccdf-1.2:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.secure_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.secure_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.secure_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.secure_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.secure_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_secure_redirects_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.secure_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.secure_redirects="$sysctl_net_ipv4_conf_default_secure_redirects_value"
fi

#
# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.secure_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.secure_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.secure_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_secure_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.secure_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects

- name: Comment out any occurrences of net.ipv4.conf.default.secure_redirects from
    config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.secure_redirects
    replace: '#net.ipv4.conf.default.secure_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_default_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_secure_redirects_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.default.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_shared_media" severity="medium">
                <xccdf-1.2:title>Configure Sending and Accepting Shared Media Redirects by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.shared_media</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.shared_media=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/>
         </html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.shared_media = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>This setting should be aligned with <html:code>net.ipv4.conf.default.secure_redirects</html:code> because it overrides it.
If <html:code>shared_media</html:code> is enabled for an interface <html:code>secure_redirects</html:code> will be enabled too.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.shared_media from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.shared_media.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.shared_media" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_shared_media_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.shared_media
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.shared_media="$sysctl_net_ipv4_conf_default_shared_media_value"
fi

#
# If net.ipv4.conf.default.shared_media present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.shared_media = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.shared_media")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_shared_media_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.shared_media\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.shared_media\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_shared_media" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_shared_media

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.shared_media.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_shared_media

- name: Comment out any occurrences of net.ipv4.conf.default.shared_media from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.shared_media
    replace: '#net.ipv4.conf.default.shared_media'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_shared_media
- name: XCCDF Value sysctl_net_ipv4_conf_default_shared_media_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_shared_media_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.shared_media is set
  sysctl:
    name: net.ipv4.conf.default.shared_media
    value: '{{ sysctl_net_ipv4_conf_default_shared_media_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_shared_media
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_shared_media_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_shared_media:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.icmp_echo_ignore_broadcasts</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.icmp_echo_ignore_broadcasts = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006030</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271873r1092331_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
<html:br/>
Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.icmp_echo_ignore_broadcasts" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>'


#
# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts="$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"
fi

#
# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_echo_ignore_broadcasts = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.icmp_echo_ignore_broadcasts")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.icmp_echo_ignore_broadcasts\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.icmp_echo_ignore_broadcasts\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006030
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006030
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
    replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006030
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- name: XCCDF Value sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
  sysctl:
    name: net.ipv4.icmp_echo_ignore_broadcasts
    value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006030
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" severity="unknown">
                <xccdf-1.2:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.icmp_ignore_bogus_error_responses</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.icmp_ignore_bogus_error_responses = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271874r1092612_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.icmp_ignore_bogus_error_responses" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>'


#
# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses="$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"
fi

#
# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_ignore_bogus_error_responses = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.icmp_ignore_bogus_error_responses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.icmp_ignore_bogus_error_responses\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.icmp_ignore_bogus_error_responses\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006031
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006031
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity

- name: Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses
    from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses
    replace: '#net.ipv4.icmp_ignore_bogus_error_responses'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006031
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.icmp_ignore_bogus_error_responses is set
  sysctl:
    name: net.ipv4.icmp_ignore_bogus_error_responses
    value: '{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-006031
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_local_port_range" severity="medium">
                <xccdf-1.2:title>Set Kernel Parameter to Increase Local Port Range</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.ip_local_port_range</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.ip_local_port_range=32768 65535</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.ip_local_port_range = 32768 65535</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>This setting defines the local port range that is used by TCP and UDP to
choose the local port. The first number is the first, the second the last
local port number.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_ip_local_port_range" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.ip_local_port_range from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.ip_local_port_range.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.ip_local_port_range" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.ip_local_port_range
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.ip_local_port_range="32768 65535"
fi

#
# If net.ipv4.ip_local_port_range present in /etc/sysctl.conf, change value to "32768 65535"
#	else, add "net.ipv4.ip_local_port_range = 32768 65535" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.ip_local_port_range")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "32768 65535"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.ip_local_port_range\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.ip_local_port_range\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_ip_local_port_range" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_local_port_range

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.ip_local_port_range.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_local_port_range

- name: Comment out any occurrences of net.ipv4.ip_local_port_range from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.ip_local_port_range
    replace: '#net.ipv4.ip_local_port_range'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_local_port_range

- name: Ensure sysctl net.ipv4.ip_local_port_range is set to 32768 65535
  sysctl:
    name: net.ipv4.ip_local_port_range
    value: 32768 65535
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_local_port_range
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_rfc1337" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.tcp_rfc1337</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.tcp_rfc1337=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.tcp_rfc1337 = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Enable TCP behavior conformant with RFC 1337. When disabled, if a RST is
received in TIME_WAIT state, we close the socket immediately without waiting
for the end of the TIME_WAIT period.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_tcp_rfc1337" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.tcp_rfc1337 from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.tcp_rfc1337.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.tcp_rfc1337" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_tcp_rfc1337_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value" use="legacy"/>'


#
# Set runtime for net.ipv4.tcp_rfc1337
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.tcp_rfc1337="$sysctl_net_ipv4_tcp_rfc1337_value"
fi

#
# If net.ipv4.tcp_rfc1337 present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.tcp_rfc1337 = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.tcp_rfc1337")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_tcp_rfc1337_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.tcp_rfc1337\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.tcp_rfc1337\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_tcp_rfc1337" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_rfc1337

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.tcp_rfc1337.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_rfc1337

- name: Comment out any occurrences of net.ipv4.tcp_rfc1337 from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.tcp_rfc1337
    replace: '#net.ipv4.tcp_rfc1337'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_rfc1337
- name: XCCDF Value sysctl_net_ipv4_tcp_rfc1337_value # promote to variable
  set_fact:
    sysctl_net_ipv4_tcp_rfc1337_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.tcp_rfc1337 is set
  sysctl:
    name: net.ipv4.tcp_rfc1337
    value: '{{ sysctl_net_ipv4_tcp_rfc1337_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_rfc1337
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_tcp_rfc1337:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_tcp_rfc1337_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" severity="medium">
                <xccdf-1.2:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.tcp_syncookies</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.tcp_syncookies=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.tcp_syncookies = 1</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001095</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002385</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000420-GPOS-00186</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000142-GPOS-00071</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006050</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271884r1092364_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_tcp_syncookies" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.tcp_syncookies from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.tcp_syncookies.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.tcp_syncookies" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_tcp_syncookies_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>'


#
# Set runtime for net.ipv4.tcp_syncookies
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.tcp_syncookies="$sysctl_net_ipv4_tcp_syncookies_value"
fi

#
# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.tcp_syncookies = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.tcp_syncookies")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_tcp_syncookies_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.tcp_syncookies\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.tcp_syncookies\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_tcp_syncookies" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006050
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.tcp_syncookies.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006050
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies

- name: Comment out any occurrences of net.ipv4.tcp_syncookies from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.tcp_syncookies
    replace: '#net.ipv4.tcp_syncookies'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006050
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies
- name: XCCDF Value sysctl_net_ipv4_tcp_syncookies_value # promote to variable
  set_fact:
    sysctl_net_ipv4_tcp_syncookies_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl net.ipv4.tcp_syncookies is set
  sysctl:
    name: net.ipv4.tcp_syncookies
    value: '{{ sysctl_net_ipv4_tcp_syncookies_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006050
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_host_parameters">
              <xccdf-1.2:title>Network Parameters for Hosts Only</xccdf-1.2:title>
              <xccdf-1.2:description>If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.all.send_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.all.send_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006032</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271875r1092337_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_all_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.all.send_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.send_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.send_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.all.send_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.send_redirects="0"
fi

#
# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.send_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.send_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.send_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_all_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006032
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.all.send_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006032
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Comment out any occurrences of net.ipv4.conf.all.send_redirects from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.all.send_redirects
    replace: '#net.ipv4.conf.all.send_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006032
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
  sysctl:
    name: net.ipv4.conf.all.send_redirects
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006032
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.conf.default.send_redirects</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.conf.default.send_redirects = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271876r1092641_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_conf_default_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.conf.default.send_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.send_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.send_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.default.send_redirects
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.send_redirects="0"
fi

#
# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.send_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.send_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.send_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_conf_default_send_redirects" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006033
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.conf.default.send_redirects.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006033
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Comment out any occurrences of net.ipv4.conf.default.send_redirects from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.conf.default.send_redirects
    replace: '#net.ipv4.conf.default.send_redirects'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006033
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
  sysctl:
    name: net.ipv4.conf.default.send_redirects
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1.1
  - DISA-STIG-OL09-00-006033
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" severity="medium">
                <xccdf-1.2:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>net.ipv4.ip_forward</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.ipv4.ip_forward=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.ipv4.ip_forward = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:warning category="functionality">Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking.
Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in
profiles or benchmarks that target usage of IPv4 forwarding.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Routing protocol daemons are typically used on routers to exchange
network topology information with other routers. If this capability is used when
not required, system network information may be unnecessarily transmitted across
the network.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_ipv4_ip_forward" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.ipv4.ip_forward from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.ip_forward.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.ip_forward" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.ip_forward
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.ipv4.ip_forward="0"
fi

#
# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.ip_forward")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.ip_forward\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.ip_forward\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_ipv4_ip_forward" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.ipv4.ip_forward.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Comment out any occurrences of net.ipv4.ip_forward from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.ipv4.ip_forward
    replace: '#net.ipv4.ip_forward'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Ensure sysctl net.ipv4.ip_forward is set to 0
  sysctl:
    name: net.ipv4.ip_forward
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_ipv4_ip_forward:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-nftables">
            <xccdf-1.2:title>nftables</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>If firewalld or iptables are being used in your environment, please follow the guidance in their
respective section and pass-over the guidance in this section.</html:code><html:br/><html:br/>
nftables is a subsystem of the Linux kernel providing filtering and classification of network
packets/datagrams/frames and is the successor to iptables. The biggest change with the
successor nftables is its simplicity. With iptables, we have to configure every single rule and
use the syntax which can be compared with normal commands. With nftables, the simpler
syntax, much like BPF (Berkely Packet Filter) means shorter lines and less repetition.
Support for nftables should also be compiled into the kernel, together with the related
nftables modules.
<html:br/>
       <html:br/> 
It is available in Linux kernels &gt;= 3.13. <html:b>Please ensure that your kernel
supports nftables before choosing this option.</html:b>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nftables_installed" severity="medium">
              <xccdf-1.2:title>Install nftables Package</xccdf-1.2:title>
              <xccdf-1.2:description>nftables provides a new in-kernel packet classification framework that is based on a
network-specific Virtual Machine (VM) and a new nft userspace command line tool.
nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure,
the connection tracking system, NAT, userspace queuing and logging subsystem.
The <html:code>nftables</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install nftables</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale><html:code>nftables</html:code> is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#service_disabled_iptables_and_service_disabled_ufw_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nftables_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if ! rpm -q --quiet "nftables" ; then
    yum install -y "nftables"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nftables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_nftables_installed

- name: Ensure nftables is installed
  package:
    name: nftables
    state: present
  when: ( ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
    )
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_nftables_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nftables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_nftables

class install_nftables {
  package { 'nftables':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nftables_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=nftables
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_nftables_installed">
[[packages]]
name = "nftables"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_nftables_installed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_nftables_installed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_nftables_disabled" severity="medium">
              <xccdf-1.2:title>Verify nftables Service is Disabled</xccdf-1.2:title>
              <xccdf-1.2:description>nftables is a subsystem of the Linux kernel providing filtering and classification of network
packets/datagrams/frames and is the successor to iptables.
The <html:code>nftables</html:code> service can be disabled with the following command:
<html:pre>systemctl disable nftables</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Running both <html:code>firewalld</html:code> and <html:code>nftables</html:code> may lead to conflict. <html:code>nftables</html:code>
is actually one of the backends for <html:code>firewalld</html:code> management tools.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_firewalld_and_package_nftables_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_nftables_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q firewalld &amp;&amp; rpm --quiet -q nftables &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'nftables.service'
fi
"$SYSTEMCTL_EXEC" disable 'nftables.service'
"$SYSTEMCTL_EXEC" mask 'nftables.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files nftables.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'nftables.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'nftables.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nftables.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_nftables_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Collect systemd Services Present in
    the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
    )
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Ensure nftables.service is Masked
  ansible.builtin.systemd:
    name: nftables.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
    )
  - service_exists.stdout_lines is search("nftables.service", multiline=True)
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Unit Socket Exists - nftables.socket
  ansible.builtin.command: systemctl -q list-unit-files nftables.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
    )
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Disable Socket nftables
  ansible.builtin.systemd:
    name: nftables.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
    )
  - socket_file_exists.stdout_lines is search("nftables.socket", multiline=True)
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_nftables_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_nftables

class disable_nftables {
  service {'nftables':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_nftables_disabled">
[customizations.services]
masked = ["nftables"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_nftables_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_nftables_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_groupowner_etc_nftables" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/nftables Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/nftables</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/nftables</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/nftables directory by the root group is important
because this directory hosts nftables configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the nftables configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_nftables"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_groupowner_etc_nftables" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q nftables; then

find -H /etc/nftables/ -maxdepth 1 -type d -exec chgrp -L root {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_groupowner_etc_nftables" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_groupowner_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/nftables/
  file:
    path: /etc/nftables/
    state: directory
    group: root
  when: '"nftables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_groupowner_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_groupowner_etc_nftables:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_groupowner_etc_nftables_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_owner_etc_nftables" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/nftables Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/nftables</html:code>, run the command: <html:pre>$ sudo chown root /etc/nftables </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/nftables directory by the root user is important
because this directory hosts nftables configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the nftables configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_nftables"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_owner_etc_nftables" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q nftables; then

find -H /etc/nftables/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_owner_etc_nftables" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_owner_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/nftables/
  file:
    path: /etc/nftables/
    state: directory
    owner: '0'
  when: '"nftables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_owner_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_owner_etc_nftables:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_owner_etc_nftables_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_etc_nftables" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/nftables Directory</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/nftables</html:code>, run the command: <html:pre>$ sudo chmod 0700 /etc/nftables</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/nftables directory is important
because this directory hosts nftables configuration. Protection of this
directory is critical for system security. Restricting the permissions
ensures exclusive control of the nftables configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_nftables"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_etc_nftables" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q nftables; then

find -H /etc/nftables/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_permissions_etc_nftables" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_permissions_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/nftables/ file(s)
  command: 'find -H /etc/nftables/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"nftables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/nftables/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"nftables" in ansible_facts.packages'
  tags:
  - configure_strategy
  - directory_permissions_etc_nftables
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_etc_nftables:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_etc_nftables_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ufw">
            <xccdf-1.2:title>Uncomplicated Firewall (ufw)</xccdf-1.2:title>
            <xccdf-1.2:description>The Linux kernel in Ubuntu provides a packet filtering system called
netfilter, and the traditional interface for manipulating netfilter are
the iptables suite of commands. iptables provide a complete firewall
solution that is both highly configurable and highly flexible.

Becoming proficient in iptables takes time, and getting started with
netfilter firewalling using only iptables can be a daunting task. As a
result, many frontends for iptables have been created over the years,
each trying to achieve a different result and targeting a different
audience.

The Uncomplicated Firewall (ufw) is a frontend for iptables and is
particularly well-suited for host-based firewalls. ufw provides a
framework for managing netfilter, as well as a command-line interface
for manipulating the firewall. ufw aims to provide an easy to use
interface for people unfamiliar with firewall concepts, while at the
same time simplifies complicated iptables commands to help an
administrator who knows what he or she is doing. ufw is an upstream
for other distributions and graphical frontends.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_ufw_enabled" severity="medium">
              <xccdf-1.2:title>Verify ufw Enabled</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>ufw</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable ufw.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ufw service must be enabled and running in order for ufw to protect the system</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_ufw_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_ufw_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ( rpm --quiet -q ufw &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ufw.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'ufw.service'
fi
"$SYSTEMCTL_EXEC" enable 'ufw.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_ufw_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_ufw_enabled

- name: Verify ufw Enabled - Enable service ufw
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Verify ufw Enabled - Enable Service ufw
    ansible.builtin.systemd:
      name: ufw
      enabled: true
      state: started
      masked: false
    when:
    - '"ufw" in ansible_facts.packages'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "ufw" in ansible_facts.packages and ("kernel" in ansible_facts.packages or "kernel-uek"
    in ansible_facts.packages) )
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_ufw_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_ufw_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_ufw

class enable_ufw {
  service {'ufw':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_ufw_enabled">
[customizations.services]
enabled = ["ufw"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_ufw_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_ufw_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-uncommon">
            <xccdf-1.2:title>Uncommon Network Protocols</xccdf-1.2:title>
            <xccdf-1.2:description>The system includes support for several network protocols which are not commonly used.
Although security vulnerabilities in kernel networking code are not frequently discovered,
the consequences can be dramatic. Ensuring uncommon network protocols are disabled
reduces the system's risk to attacks targeted at its implementation of those protocols.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Although these protocols are not commonly used, avoid disruption
in your network environment by ensuring they are not needed
prior to disabling them.</xccdf-1.2:warning>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" severity="medium">
              <xccdf-1.2:title>Disable ATM Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Asynchronous Transfer Mode (ATM) is a protocol operating on
network, data link, and physical layers, based on virtual circuits
and virtual paths.

To configure the system to prevent the <html:code>atm</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/atm.conf</html:code>:
<html:pre>install atm /bin/false</html:pre>

To configure the system to prevent the <html:code>atm</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/atm.conf</html:code>:
<html:pre>blacklist atm</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271443r1092463_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling ATM protects the system against exploitation of any
flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_atm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install atm" /etc/modprobe.d/atm.conf ; then
	
	sed -i 's#^install atm.*#install atm /bin/false#g' /etc/modprobe.d/atm.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/atm.conf
	echo "install atm /bin/false" &gt;&gt; /etc/modprobe.d/atm.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist atm$" /etc/modprobe.d/atm.conf ; then
	echo "blacklist atm" &gt;&gt; /etc/modprobe.d/atm.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_atm_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000040
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_atm_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'atm' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/atm.conf
    regexp: install\s+atm
    line: install atm /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000040
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_atm_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'atm' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/atm.conf
    regexp: ^blacklist atm$
    line: blacklist atm
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000040
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_atm_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_atm_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" severity="medium">
              <xccdf-1.2:title>Disable CAN Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Controller Area Network (CAN) is a serial communications
protocol which was initially developed for automotive and
is now also used in marine, industrial, and medical applications.

To configure the system to prevent the <html:code>can</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/can.conf</html:code>:
<html:pre>install can /bin/false</html:pre>

To configure the system to prevent the <html:code>can</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/can.conf</html:code>:
<html:pre>blacklist can</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000041</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271444r1091044_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling CAN protects the system against exploitation of any
flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_can_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install can" /etc/modprobe.d/can.conf ; then
	
	sed -i 's#^install can.*#install can /bin/false#g' /etc/modprobe.d/can.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/can.conf
	echo "install can /bin/false" &gt;&gt; /etc/modprobe.d/can.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist can$" /etc/modprobe.d/can.conf ; then
	echo "blacklist can" &gt;&gt; /etc/modprobe.d/can.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_can_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000041
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_can_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'can' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/can.conf
    regexp: install\s+can
    line: install can /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000041
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_can_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'can' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/can.conf
    regexp: ^blacklist can$
    line: blacklist can
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000041
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_can_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_can_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" severity="medium">
              <xccdf-1.2:title>Disable DCCP Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.

To configure the system to prevent the <html:code>dccp</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/dccp.conf</html:code>:
<html:pre>install dccp /bin/false</html:pre>

To configure the system to prevent the <html:code>dccp</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/dccp.conf</html:code>:
<html:pre>blacklist dccp</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling DCCP protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_dccp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install dccp" /etc/modprobe.d/dccp.conf ; then
	
	sed -i 's#^install dccp.*#install dccp /bin/false#g' /etc/modprobe.d/dccp.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/dccp.conf
	echo "install dccp /bin/false" &gt;&gt; /etc/modprobe.d/dccp.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist dccp$" /etc/modprobe.d/dccp.conf ; then
	echo "blacklist dccp" &gt;&gt; /etc/modprobe.d/dccp.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_dccp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_dccp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'dccp' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/dccp.conf
    regexp: install\s+dccp
    line: install dccp /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_dccp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'dccp' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/dccp.conf
    regexp: ^blacklist dccp$
    line: blacklist dccp
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_dccp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_dccp_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" severity="low">
              <xccdf-1.2:title>Disable IEEE 1394 (FireWire) Support</xccdf-1.2:title>
              <xccdf-1.2:description>The IEEE 1394 (FireWire) is a serial bus standard for
high-speed real-time communication.

To configure the system to prevent the <html:code>firewire-core</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/firewire-core.conf</html:code>:
<html:pre>install firewire-core /bin/false</html:pre>

To configure the system to prevent the <html:code>firewire-core</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/firewire-core.conf</html:code>:
<html:pre>blacklist firewire-core</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271445r1091047_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling FireWire protects the system against exploitation of any
flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_firewire-core_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install firewire-core" /etc/modprobe.d/firewire-core.conf ; then
	
	sed -i 's#^install firewire-core.*#install firewire-core /bin/false#g' /etc/modprobe.d/firewire-core.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/firewire-core.conf
	echo "install firewire-core /bin/false" &gt;&gt; /etc/modprobe.d/firewire-core.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist firewire-core$" /etc/modprobe.d/firewire-core.conf ; then
	echo "blacklist firewire-core" &gt;&gt; /etc/modprobe.d/firewire-core.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_firewire-core_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000042
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_firewire-core_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'firewire-core' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/firewire-core.conf
    regexp: install\s+firewire-core
    line: install firewire-core /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000042
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_firewire-core_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'firewire-core' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/firewire-core.conf
    regexp: ^blacklist firewire-core$
    line: blacklist firewire-core
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000042
  - NIST-800-53-AC-18
  - disable_strategy
  - kernel_module_firewire-core_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_firewire-core_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_firewire-core_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" severity="low">
              <xccdf-1.2:title>Disable RDS Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high-bandwidth,
low-latency communications between nodes in a cluster.

To configure the system to prevent the <html:code>rds</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/rds.conf</html:code>:
<html:pre>install rds /bin/false</html:pre>

To configure the system to prevent the <html:code>rds</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/rds.conf</html:code>:
<html:pre>blacklist rds</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling RDS protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_rds_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install rds" /etc/modprobe.d/rds.conf ; then
	
	sed -i 's#^install rds.*#install rds /bin/false#g' /etc/modprobe.d/rds.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/rds.conf
	echo "install rds /bin/false" &gt;&gt; /etc/modprobe.d/rds.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist rds$" /etc/modprobe.d/rds.conf ; then
	echo "blacklist rds" &gt;&gt; /etc/modprobe.d/rds.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_rds_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_rds_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'rds' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/rds.conf
    regexp: install\s+rds
    line: install rds /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_rds_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'rds' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/rds.conf
    regexp: ^blacklist rds$
    line: blacklist rds
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_rds_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_rds_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" severity="medium">
              <xccdf-1.2:title>Disable SCTP Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Stream Control Transmission Protocol (SCTP) is a
transport layer protocol, designed to support the idea of
message-oriented communication, with several streams of messages
within one connection.

To configure the system to prevent the <html:code>sctp</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/sctp.conf</html:code>:
<html:pre>install sctp /bin/false</html:pre>

To configure the system to prevent the <html:code>sctp</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/sctp.conf</html:code>:
<html:pre>blacklist sctp</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000043</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271446r1091050_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling SCTP protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_sctp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install sctp" /etc/modprobe.d/sctp.conf ; then
	
	sed -i 's#^install sctp.*#install sctp /bin/false#g' /etc/modprobe.d/sctp.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/sctp.conf
	echo "install sctp /bin/false" &gt;&gt; /etc/modprobe.d/sctp.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist sctp$" /etc/modprobe.d/sctp.conf ; then
	echo "blacklist sctp" &gt;&gt; /etc/modprobe.d/sctp.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_sctp_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1
  - DISA-STIG-OL09-00-000043
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_sctp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'sctp' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/sctp.conf
    regexp: install\s+sctp
    line: install sctp /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1
  - DISA-STIG-OL09-00-000043
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_sctp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'sctp' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/sctp.conf
    regexp: ^blacklist sctp$
    line: blacklist sctp
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.10.1
  - DISA-STIG-OL09-00-000043
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_sctp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_sctp_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_sctp_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" severity="low">
              <xccdf-1.2:title>Disable TIPC Support</xccdf-1.2:title>
              <xccdf-1.2:description>The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.

To configure the system to prevent the <html:code>tipc</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/tipc.conf</html:code>:
<html:pre>install tipc /bin/false</html:pre>

To configure the system to prevent the <html:code>tipc</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/tipc.conf</html:code>:
<html:pre>blacklist tipc</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as
a node in High Performance Computing cluster, it is expected that
the <html:code>tipc</html:code> kernel module will be loaded.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000044</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271447r1092464_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling TIPC protects
the system against exploitation of any flaws in its implementation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_tipc_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install tipc" /etc/modprobe.d/tipc.conf ; then
	
	sed -i 's#^install tipc.*#install tipc /bin/false#g' /etc/modprobe.d/tipc.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/tipc.conf
	echo "install tipc /bin/false" &gt;&gt; /etc/modprobe.d/tipc.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist tipc$" /etc/modprobe.d/tipc.conf ; then
	echo "blacklist tipc" &gt;&gt; /etc/modprobe.d/tipc.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_tipc_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000044
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_tipc_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'tipc' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/tipc.conf
    regexp: install\s+tipc
    line: install tipc /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000044
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_tipc_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'tipc' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/tipc.conf
    regexp: ^blacklist tipc$
    line: blacklist tipc
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000044
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_tipc_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_tipc_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-wireless">
            <xccdf-1.2:title>Wireless Networking</xccdf-1.2:title>
            <xccdf-1.2:description>Wireless networking, such as 802.11
(WiFi) and Bluetooth, can present a security risk to sensitive or
classified systems and networks. Wireless networking hardware is
much more likely to be included in laptop or portable systems than
in desktops or servers. 
<html:br/>
       <html:br/>
Removal of hardware provides the greatest assurance that the wireless
capability remains disabled. Acquisition policies often include provisions to
prevent the purchase of equipment that will be used in sensitive spaces and
includes wireless capabilities. If it is impractical to remove the wireless
hardware, and policy permits the device to enter sensitive spaces as long
as wireless is disabled, efforts should instead focus on disabling wireless capability
via software.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_wireless_software">
              <xccdf-1.2:title>Disable Wireless Through Software Configuration</xccdf-1.2:title>
              <xccdf-1.2:description>If it is impossible to remove the wireless hardware
from the device in question, disable as much of it as possible
through software. The following methods can disable software
support for wireless networking, but note that these methods do not
prevent malicious software or careless users from re-activating the
devices.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" severity="medium">
                <xccdf-1.2:title>Disable Bluetooth Kernel Module</xccdf-1.2:title>
                <xccdf-1.2:description>The kernel's module loading system can be configured to prevent
loading of the Bluetooth module. Add the following to
the appropriate <html:code>/etc/modprobe.d</html:code> configuration file
to prevent the loading of the Bluetooth module:
<html:pre>install bluetooth /bin/true</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001443</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000300-GPOS-00118</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000046</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271449r1091059_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If Bluetooth functionality must be disabled, preventing the kernel
from loading the kernel module provides an additional safeguard against its
activation.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_bluetooth_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install bluetooth" /etc/modprobe.d/bluetooth.conf ; then
	
	sed -i 's#^install bluetooth.*#install bluetooth /bin/false#g' /etc/modprobe.d/bluetooth.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/bluetooth.conf
	echo "install bluetooth /bin/false" &gt;&gt; /etc/modprobe.d/bluetooth.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist bluetooth$" /etc/modprobe.d/bluetooth.conf ; then
	echo "blacklist bluetooth" &gt;&gt; /etc/modprobe.d/bluetooth.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_bluetooth_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.13.1.3
  - DISA-STIG-OL09-00-000046
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - kernel_module_bluetooth_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'bluetooth' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/bluetooth.conf
    regexp: install\s+bluetooth
    line: install bluetooth /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.13.1.3
  - DISA-STIG-OL09-00-000046
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - kernel_module_bluetooth_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'bluetooth' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/bluetooth.conf
    regexp: ^blacklist bluetooth$
    line: blacklist bluetooth
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.13.1.3
  - DISA-STIG-OL09-00-000046
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - kernel_module_bluetooth_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_bluetooth_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" severity="medium">
                <xccdf-1.2:title>Deactivate Wireless Network Interfaces</xccdf-1.2:title>
                <xccdf-1.2:description>Deactivating wireless network interfaces should prevent normal usage of the wireless
capability.
<html:br/>
         <html:br/>

Configure the system to disable all wireless network interfaces with the following command:
<html:pre>$ sudo nmcli radio all off</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001443</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001444</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1315</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1319</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-18(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000299-GPOS-00117</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000300-GPOS-00118</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000481-GPOS-000481</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006001</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271859r1092289_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The use of wireless networking can introduce many different attack vectors into
the organization's network. Common attack vectors such as malicious association
and ad hoc networks will allow an attacker to spoof a wireless access point
(AP), allowing validated systems to connect to the malicious AP and enabling the
attacker to monitor and record network traffic. These malicious APs can also
serve to create a man-in-the-middle attack or be used to create a denial of
service to valid network resources.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#wifi-iface"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="wireless_disable_interfaces">
if ! rpm -q --quiet "NetworkManager" ; then
    yum install -y "NetworkManager"
fi

if command -v nmcli &gt;/dev/null 2&gt;&amp;1 &amp;&amp; systemctl is-active NetworkManager &gt;/dev/null 2&gt;&amp;1; then
    nmcli radio all off
fi

if command -v wicked &gt;/dev/null 2&gt;&amp;1 &amp;&amp; systemctl is-active wickedd &gt;/dev/null 2&gt;&amp;1; then
  if [ -n "$(find /sys/class/net/*/ -type d -name wireless)" ]; then
    interfaces=$(find /sys/class/net/*/wireless -type d -name wireless | xargs -0 dirname | xargs basename)
    for iface in $interfaces; do
      wicked ifdown $iface
      sed -i 's/STARTMODE=.*/STARTMODE=off/' /etc/sysconfig/network/ifcfg-$iface
    done
  fi
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="wireless_disable_interfaces" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006001
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Service facts
  ansible.builtin.service_facts: null
  tags:
  - DISA-STIG-OL09-00-006001
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Ensure NetworkManager is installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - NetworkManager
  tags:
  - DISA-STIG-OL09-00-006001
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: NetworkManager Deactivate Wireless Network Interfaces
  command: nmcli radio wifi off
  when:
  - '''NetworkManager'' in ansible_facts.packages'
  - ansible_facts.services['NetworkManager.service'].state == 'running'
  tags:
  - DISA-STIG-OL09-00-006001
  - NIST-800-171-3.1.16
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-wireless_disable_interfaces:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_networkmanager">
            <xccdf-1.2:title>Network Manager</xccdf-1.2:title>
            <xccdf-1.2:description>The NetworkManager daemon configures a variety of network connections.
This section discusses how to configure NetworkManager.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_networkmanager_dns_mode" type="string" interactive="true">
              <xccdf-1.2:title>NetworkManager DNS Mode</xccdf-1.2:title>
              <xccdf-1.2:description>This sets how NetworkManager handles DNS.

none -  NetworkManager will not modify resolv.conf.
default - NetworkManager will update /etc/resolv.conf to reflect the nameservers provided by currently active connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="none">none</xccdf-1.2:value>
              <xccdf-1.2:value>default</xccdf-1.2:value>
              <xccdf-1.2:value selector="explicit_default">default</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_networkmanager_dns_mode" severity="medium">
              <xccdf-1.2:title>NetworkManager DNS Mode Must Be Must Configured</xccdf-1.2:title>
              <xccdf-1.2:description>The DNS processing mode in NetworkManager describes how DNS is processed on the system. Depending the mode some changes the system's DNS may not be respected.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-006002</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271860r1092292_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To ensure that DNS resolver settings are respected, a DNS mode in NetworkManager must be configured.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_networkmanager"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="networkmanager_dns_mode" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q NetworkManager; then

var_networkmanager_dns_mode='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_networkmanager_dns_mode" use="legacy"/>'



# Try find '[main]' and 'dns' in '/etc/NetworkManager/NetworkManager.conf', if it exists, set
# to '$var_networkmanager_dns_mode', if it isn't here, add it, if '[main]' doesn't exist, add it there
if grep -qzosP '[[:space:]]*\[main]([^\n\[]*\n+)+?[[:space:]]*dns' '/etc/NetworkManager/NetworkManager.conf'; then
    
    sed -i "s/dns[^(\n)]*/dns=$var_networkmanager_dns_mode/" '/etc/NetworkManager/NetworkManager.conf'
elif grep -qs '[[:space:]]*\[main]' '/etc/NetworkManager/NetworkManager.conf'; then
    sed -i "/[[:space:]]*\[main]/a dns=$var_networkmanager_dns_mode" '/etc/NetworkManager/NetworkManager.conf'
else
    if test -d "/etc/NetworkManager"; then
        printf '%s\n' '[main]' "dns=$var_networkmanager_dns_mode" &gt;&gt; '/etc/NetworkManager/NetworkManager.conf'
    else
        echo "Config file directory '/etc/NetworkManager' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
    fi
fi

if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    systemctl reload NetworkManager
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="networkmanager_dns_mode" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-006002
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - networkmanager_dns_mode
  - no_reboot_needed
- name: XCCDF Value var_networkmanager_dns_mode # promote to variable
  set_fact:
    var_networkmanager_dns_mode: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_networkmanager_dns_mode" use="legacy"/>
  tags:
    - always

- name: Set 'dns' to '{{ var_networkmanager_dns_mode }}' in the [main] section of
    '/etc/NetworkManager/NetworkManager.conf'
  ini_file:
    path: /etc/NetworkManager/NetworkManager.conf
    section: main
    option: dns
    value: '{{ var_networkmanager_dns_mode }}'
    create: true
    mode: 420
    no_extra_spaces: true
  when: '"NetworkManager" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-006002
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - networkmanager_dns_mode
  - no_reboot_needed

- name: NetworkManager DNS Mode Must Be Must Configured - Ensure Network Manager
  ansible.builtin.systemd:
    name: NetworkManager
    state: reloaded
  when: '"NetworkManager" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-006002
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - networkmanager_dns_mode
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-networkmanager_dns_mode:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-networkmanager_dns_mode_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions">
          <xccdf-1.2:title>File Permissions and Masks</xccdf-1.2:title>
          <xccdf-1.2:description>Traditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
<html:br/>
      <html:br/>
Several of the commands in this section search filesystems
for files or directories with certain characteristics, and are
intended to be run on every local partition on a given system.
When the variable <html:i>PART</html:i> appears in one of the commands below,
it means that the command is intended to be run repeatedly, with the
name of each local partition substituted for <html:i>PART</html:i> in turn.
<html:br/>
      <html:br/>
The following command prints a list of all xfs partitions on the local
system, which is the default filesystem for Oracle Linux 9
installations:
<html:pre>$ mount -t xfs | awk '{print $3}'</html:pre>
For any systems that use a different
local filesystem type, modify this command as appropriate.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_files">
            <xccdf-1.2:title>Verify Permissions on Important Files and
Directories</xccdf-1.2:title>
            <xccdf-1.2:description>Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned" severity="medium">
              <xccdf-1.2:title>Ensure All World-Writable Directories Are Owned by root User</xccdf-1.2:title>
              <xccdf-1.2:description>All directories in local partitions which are world-writable should be owned by root.
If any world-writable directories are not owned by root, this should be investigated.
Following this, the files should be deleted or assigned to root user.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R54</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002516</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271785r1092067_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing a user account to own a world-writable directory is undesirable because it allows the
owner of that directory to remove or replace any files that may be placed in the directory by
other users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_perms_world_writable_root_owned" complexity="low" disruption="medium" reboot="false" strategy="restrict">
# At least under containerized env /proc can have files w/o possilibity to
# modify even as root. And touching /proc is not good idea anyways.
find / -path /proc -prune -o \
    -not -fstype afs -not -fstype ceph -not -fstype cifs -not -fstype smb3 -not -fstype smbfs \
    -not -fstype sshfs -not -fstype ncpfs -not -fstype ncp -not -fstype nfs -not -fstype nfs4 \
    -not -fstype gfs -not -fstype gfs2 -not -fstype glusterfs -not -fstype gpfs \
    -not -fstype pvfs2 -not -fstype ocfs2 -not -fstype lustre -not -fstype davfs \
    -not -fstype fuse.sshfs -type d -perm -0002 -uid +0 -exec chown root {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_perms_world_writable_root_owned" complexity="low" disruption="medium" reboot="false" strategy="restrict">- name: Ensure All World-Writable Directories Are Owned by root User - Define Excluded
    (Non-Local) File Systems and Paths
  ansible.builtin.set_fact:
    excluded_fstypes:
    - afs
    - ceph
    - cifs
    - smb3
    - smbfs
    - sshfs
    - ncpfs
    - ncp
    - nfs
    - nfs4
    - gfs
    - gfs2
    - glusterfs
    - gpfs
    - pvfs2
    - ocfs2
    - lustre
    - davfs
    - fuse.sshfs
    excluded_paths:
    - dev
    - proc
    - run
    - sys
    search_paths: []
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Find Relevant
    Root Directories Ignoring Pre-Defined Excluded Paths
  ansible.builtin.find:
    paths: /
    file_type: directory
    excludes: '{{ excluded_paths }}'
    hidden: true
    recurse: false
  register: result_relevant_root_dirs
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Include Relevant
    Root Directories in a List of Paths to be Searched
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.path]) }}'
  loop: '{{ result_relevant_root_dirs.files }}'
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Increment Search
    Paths List with Local Partitions Mount Points
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when:
  - item.fstype not in excluded_fstypes
  - item.mount != '/'
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Increment Search
    Paths List with Local NFS File System Targets
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.device is search("localhost:")
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Define Rule
    Specific Facts
  ansible.builtin.set_fact:
    world_writable_dirs: []
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Find All Uncompliant
    Directories in Local File Systems
  ansible.builtin.command:
    cmd: find {{ item }} -xdev -type d -perm -0002 -uid +0
  loop: '{{ search_paths }}'
  changed_when: false
  register: result_found_dirs
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Create List
    of World Writable Directories Not Owned by root
  ansible.builtin.set_fact:
    world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
      }}'
  loop: '{{ result_found_dirs.results }}'
  when: item is not skipped
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All World-Writable Directories Are Owned by root User - Ensure root
    Ownership on Local World Writable Directories
  ansible.builtin.file:
    path: '{{ item }}'
    owner: root
  loop: '{{ world_writable_dirs }}'
  tags:
  - DISA-STIG-OL09-00-002516
  - dir_perms_world_writable_root_owned
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_perms_world_writable_root_owned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_perms_world_writable_root_owned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" severity="medium">
              <xccdf-1.2:title>Verify that All World-Writable Directories Have Sticky Bits Set</xccdf-1.2:title>
              <xccdf-1.2:description>When the so-called 'sticky bit' is set on a directory, only the owner of a given file may
remove that file from the directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky bit prevents users from
removing each other's files. In cases where there is no reason for a directory to be
world-writable, a better solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application, consult that application's
documentation instead of blindly changing modes.
<html:br/>
To set the sticky bit on a world-writable directory <html:i>DIR</html:i>, run the following command:
<html:pre>$ sudo chmod +t <html:i>DIR</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of directories present on the system. It is
not a problem in most cases, but especially systems with a large number of directories can
be affected. See <html:code>https://access.redhat.com/articles/6999111</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R54</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002510</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271779r1092049_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Failing to set the sticky bit on public directories allows unauthorized users to delete files
in the directory structure.
<html:br/>
        <html:br/>
The only authorized public directories are those temporary directories supplied with the
system, or those designed to be temporary file repositories. The setting is normally reserved
for directories used by the system, by users for temporary file storage (such as <html:code>/tmp</html:code>),
and for directories requiring global read/write access.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_perms_world_writable_sticky_bits">df --local -P | awk '{if (NR!=1) print $6}' \
| xargs -I '$6' find '$6' -xdev -type d \
\( -perm -0002 -a ! -perm -1000 \) 2&gt;/dev/null \
-exec chmod a+t {} +
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_perms_world_writable_sticky_bits" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Verify that All World-Writable Directories Have Sticky Bits Set - Define Excluded
    (Non-Local) File Systems and Paths
  ansible.builtin.set_fact:
    excluded_fstypes:
    - afs
    - ceph
    - cifs
    - smb3
    - smbfs
    - sshfs
    - ncpfs
    - ncp
    - nfs
    - nfs4
    - gfs
    - gfs2
    - glusterfs
    - gpfs
    - pvfs2
    - ocfs2
    - lustre
    - davfs
    - fuse.sshfs
    excluded_paths:
    - dev
    - proc
    - run
    - sys
    search_paths: []
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Find Relevant
    Root Directories Ignoring Pre-Defined Excluded Paths
  ansible.builtin.find:
    paths: /
    file_type: directory
    excludes: '{{ excluded_paths }}'
    hidden: true
    recurse: false
  register: result_relevant_root_dirs
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Include
    Relevant Root Directories in a List of Paths to be Searched
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.path]) }}'
  loop: '{{ result_relevant_root_dirs.files }}'
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Increment
    Search Paths List with Local Partitions Mount Points
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when:
  - item.fstype not in excluded_fstypes
  - item.mount != '/'
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Increment
    Search Paths List with Local NFS File System Targets
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.device is search("localhost:")
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Define Rule
    Specific Facts
  ansible.builtin.set_fact:
    world_writable_dirs: []
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Find All
    Uncompliant Directories in Local File Systems
  ansible.builtin.command:
    cmd: find {{ item }} -xdev -type d ( -perm -0002 -a ! -perm -1000 )
  loop: '{{ search_paths }}'
  changed_when: false
  register: result_found_dirs
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Create List
    of World Writable Directories Without Sticky Bit
  ansible.builtin.set_fact:
    world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
      }}'
  loop: '{{ result_found_dirs.results }}'
  when: result_found_dirs is not skipped and item is not skipped
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Ensure Sticky
    Bit is Set on Local World Writable Directories
  ansible.builtin.file:
    path: '{{ item }}'
    mode: a+t
  loop: '{{ world_writable_dirs }}'
  tags:
  - DISA-STIG-OL09-00-002510
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_perms_world_writable_sticky_bits:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_system_commands_group_root_owned" severity="medium">
              <xccdf-1.2:title>Verify that system commands directories have root as a group owner</xccdf-1.2:title>
              <xccdf-1.2:description>System commands are stored in the following directories:
by default:
<html:pre>/bin 
/sbin 
/usr/bin 
/usr/sbin 
/usr/local/bin 
/usr/local/sbin
</html:pre>
All these directories should have <html:code>root</html:code> user as a group owner. 
If any system command directory is not group owned by a user other than root 
correct its ownership with the following command:
<html:pre>$ sudo chgrp root <html:i>DIR</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the operating system were to allow any user to make changes to 
software libraries, then those changes might be implemented without 
undergoing the appropriate testing and approvals that are part of a 
robust change management process.

This requirement applies to operating systems with software libraries
that are accessible and configurable, as in the case of interpreted languages. 
Software libraries also include privileged programs which execute with escalated 
privileges. Only qualified and authorized individuals must be allowed to obtain 
access to information system components for purposes of initiating changes, 
including upgrades and modifications.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_system_commands_group_root_owned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_system_commands_group_root_owned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_system_commands_root_owned" severity="medium">
              <xccdf-1.2:title>Verify that system commands directories have root ownership</xccdf-1.2:title>
              <xccdf-1.2:description>System commands are stored in the following directories by default:
<html:pre>/bin 
/sbin 
/usr/bin 
/usr/sbin 
/usr/local/bin 
/usr/local/sbin
</html:pre>
All these directories should be owned by the <html:code>root</html:code> user. 
If any system command directory is not owned by a user other than root 
correct its ownership with the following command:
<html:pre>$ sudo chown root <html:i>DIR</html:i>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the operating system were to allow any user to make changes to 
software libraries, then those changes might be implemented without 
undergoing the appropriate testing and approvals that are part of a 
robust change management process.

This requirement applies to operating systems with software libraries
that are accessible and configurable, as in the case of interpreted languages. 
Software libraries also include privileged programs which execute with escalated 
privileges. Only qualified and authorized individuals must be allowed to obtain 
access to information system components for purposes of initiating changes, 
including upgrades and modifications.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_system_commands_root_owned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_system_commands_root_owned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_crypttab" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/crypttab File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/crypttab</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/crypttab</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/crypttab file by the root group is important
because this file hosts encrypted block devices configuration. Protection
of this file is critical for system security. Assigning the ownership to
root ensures exclusive control of the encrypted block devices
configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_crypttab" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp root /etc/crypttab
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_crypttab" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/crypttab
  stat:
    path: /etc/crypttab
  register: file_exists
  tags:
  - configure_strategy
  - file_groupowner_etc_crypttab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner root on /etc/crypttab
  file:
    path: /etc/crypttab
    group: root
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_crypttab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_crypttab:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_crypttab_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_systemmap" severity="low">
              <xccdf-1.2:title>Verify Group Who Owns System.map Files</xccdf-1.2:title>
              <xccdf-1.2:description>The System.map files are symbol map files generated during the compilation of the Linux
kernel. They contain the mapping between kernel symbols and their corresponding memory
addresses. These files must be group-owned by root.


To properly set the group owner of <html:code>/boot/System.map*</html:code>, run the command:
<html:pre>$ sudo chgrp root /boot/System.map*</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The purpose of <html:code>System.map</html:code> files is primarily for debugging and profiling the kernel.
Unrestricted access to these files might disclose information useful to attackers and
malicious software leading to more sophisticated exploitation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_systemmap" complexity="low" disruption="low" reboot="false" strategy="configure">
find -L /boot/ -maxdepth 1 -type f ! -group root -regextype posix-extended -regex '^.*System\.map.*$' -exec chgrp -L root {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_systemmap" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /boot/ file(s) matching ^.*System\.map.*$
  command: find -H /boot/ -maxdepth 1 -type f ! -group root -regextype posix-extended
    -regex "^.*System\.map.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - file_groupowner_systemmap
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Ensure group owner on /boot/ file(s) matching ^.*System\.map.*$
  file:
    path: '{{ item }}'
    group: root
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - file_groupowner_systemmap
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_systemmap:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_systemmap_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_crypttab" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/crypttab File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the owner of <html:code>/etc/crypttab</html:code>, run the command: <html:pre>$ sudo chown root /etc/crypttab </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The ownership of the /etc/crypttab file by the root user is important
because this file hosts encrypted block devices configuration. Protection
of this file is critical for system security. Assigning the ownership to
root ensures exclusive control of the encrypted block devices
configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_crypttab" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/crypttab
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_crypttab" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/crypttab
  stat:
    path: /etc/crypttab
  register: file_exists
  tags:
  - configure_strategy
  - file_owner_etc_crypttab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/crypttab
  file:
    path: /etc/crypttab
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_crypttab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_crypttab:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_crypttab_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_systemmap" severity="low">
              <xccdf-1.2:title>Verify User Who Owns System.map Files</xccdf-1.2:title>
              <xccdf-1.2:description>The System.map files are symbol map files generated during the compilation of the Linux
kernel. They contain the mapping between kernel symbols and their corresponding memory
addresses. These files must be owned by root.


To properly set the owner of <html:code>/boot/System.map*</html:code>, run the command:
<html:pre>$ sudo chown root /boot/System.map* </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The purpose of <html:code>System.map</html:code> files is primarily for debugging and profiling the kernel.
Unrestricted access to these files might disclose information useful to attackers and
malicious software leading to more sophisticated exploitation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_systemmap" complexity="low" disruption="low" reboot="false" strategy="configure">
find -L /boot/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex '^.*System\.map.*$' -exec chown -L 0 {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_systemmap" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /boot/ file(s) matching ^.*System\.map.*$
  command: find -H /boot/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex
    "^.*System\.map.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - file_owner_systemmap
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Ensure owner on /boot/ file(s) matching ^.*System\.map.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - file_owner_systemmap
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_systemmap:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_systemmap_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_crypttab" severity="medium">
              <xccdf-1.2:title>Verify Permissions On /etc/crypttab File</xccdf-1.2:title>
              <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/crypttab</html:code>, run the command: <html:pre>$ sudo chmod 0600 /etc/crypttab</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting correct permissions on the /etc/crypttab file is important
because this file hosts encrypted block devices configuration. Protection
of this file is critical for system security. Assigning the ownership to
root ensures exclusive control of the encrypted block devices
configuration.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_crypttab" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xwrs,o-xwrt /etc/crypttab
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_crypttab" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/crypttab
  stat:
    path: /etc/crypttab
  register: file_exists
  tags:
  - configure_strategy
  - file_permissions_etc_crypttab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/crypttab
  file:
    path: /etc/crypttab
    mode: u-xs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_crypttab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_crypttab:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_crypttab_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_systemmap" severity="low">
              <xccdf-1.2:title>Verify Permissions on System.map Files</xccdf-1.2:title>
              <xccdf-1.2:description>The System.map files are symbol map files generated during the compilation of the Linux
kernel. They contain the mapping between kernel symbols and their corresponding memory
addresses. In general, there is no need for non-root users to read these files.


To properly set the permissions of <html:code>/boot/System.map*</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /boot/System.map*</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The purpose of <html:code>System.map</html:code> files is primarily for debugging and profiling the kernel.
Unrestricted access to these files might disclose information useful to attackers and
malicious software leading to more sophisticated exploitation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_systemmap" complexity="low" disruption="low" reboot="false" strategy="configure">



find -L /boot/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*System\.map.*$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_systemmap" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /boot/ file(s)
  command: find -H /boot/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype
    posix-extended -regex "^.*System\.map.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - file_permissions_systemmap
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Set permissions for /boot/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xwrs,o-xwrt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - file_permissions_systemmap
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_systemmap:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid" severity="medium">
              <xccdf-1.2:title>Ensure All SGID Executables Are Authorized</xccdf-1.2:title>
              <xccdf-1.2:description>The SGID (set group id) bit should be set only on files that were installed via authorized
means. A straightforward means of identifying unauthorized SGID files is determine if any were
not installed as part of an RPM package, which is cryptographically verified. Investigate the
origin of any unpackaged SGID files. This configuration check considers authorized SGID files
those which were installed via RPM. It is assumed that when an individual has sudo access to
install an RPM and all packages are signed with an organizationally-recognized GPG key, the
software should be considered an approved package on the system. Any SGID file not deployed
through an RPM will be flagged for further review.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code>https://access.redhat.com/articles/6999111</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R56</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Executable files with the SGID permission run with the privileges of the owner of the file.
SGID files of uncertain provenance could allow for unprivileged users to elevate privileges.
The presence of these files should be strictly controlled on the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_unauthorized_sgid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_suid" severity="medium">
              <xccdf-1.2:title>Ensure All SUID Executables Are Authorized</xccdf-1.2:title>
              <xccdf-1.2:description>The SUID (set user id) bit should be set only on files that were installed via authorized
means. A straightforward means of identifying unauthorized SUID files is determine if any were
not installed as part of an RPM package, which is cryptographically verified. Investigate the
origin of any unpackaged SUID files. This configuration check considers authorized SUID files
those which were installed via RPM. It is assumed that when an individual has sudo access to
install an RPM and all packages are signed with an organizationally-recognized GPG key, the
software should be considered an approved package on the system. Any SUID file not deployed
through an RPM will be flagged for further review.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code>https://access.redhat.com/articles/6999111</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R56</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Executable files with the SUID permission run with the privileges of the owner of the file.
SUID files of uncertain provenance could allow for unprivileged users to elevate privileges.
The presence of these files should be strictly controlled on the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_unauthorized_suid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" severity="medium">
              <xccdf-1.2:title>Ensure No World-Writable Files Exist</xccdf-1.2:title>
              <xccdf-1.2:description>It is generally a good idea to remove global (other) write access to a file when it is
discovered. However, check with documentation for specific applications before making changes.
Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured
application or user account. Finally, this applies to real files and not virtual files that
are a part of pseudo file systems such as <html:code>sysfs</html:code> or <html:code>procfs</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code>https://access.redhat.com/articles/6999111</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R54</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Data in world-writable files can be modified by any user on the system. In almost all
circumstances, files can be configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk caused by world-writable files.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_unauthorized_world_writable" complexity="low" disruption="low" reboot="false" strategy="configure">
FILTER_NODEV=$(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

# Do not consider /sysroot partition because it contains only the physical
# read-only root on bootable containers.
PARTITIONS=$(findmnt -n -l -k -it $FILTER_NODEV | awk '{ print $1 }' | grep -v "/sysroot")

for PARTITION in $PARTITIONS; do
  find "${PARTITION}" -xdev -type f -perm -002 -exec chmod o-w {} \; 2&gt;/dev/null
done

# Ensure /tmp is also fixed when tmpfs is used.
if grep "^tmpfs /tmp" /proc/mounts; then
  find /tmp -xdev -type f -perm -002 -exec chmod o-w {} \; 2&gt;/dev/null
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_unauthorized_world_writable:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" severity="medium">
              <xccdf-1.2:title>Ensure All Files Are Owned by a Group</xccdf-1.2:title>
              <xccdf-1.2:description>If any file is not group-owned by a valid defined group, the cause of the lack of
group-ownership must be investigated. Following this, those files should be deleted or
assigned to an appropriate group. The groups need to be defined in <html:code>/etc/group</html:code>
or in <html:code>/usr/lib/group</html:code> if <html:code>nss-altfiles</html:code> are configured to be used
in <html:code>/etc/nsswitch.conf</html:code>.

Locate the mount points related to local devices by the following command:
<html:pre>$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)</html:pre>

For all mount points listed by the previous command, it is necessary to search for files which
do not belong to a valid group using the following command:
<html:pre>$ sudo find <html:i>MOUNTPOINT</html:i> -xdev -nogroup 2&gt;/dev/null</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule only considers local groups as valid groups.
If you have your groups defined outside <html:code>/etc/group</html:code> or <html:code>/usr/lib/group</html:code>, the rule won't consider those.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code>https://access.redhat.com/articles/6999111</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R53</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002511</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271780r1092052_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unowned files do not directly imply a security problem, but they are generally a sign that
something is amiss. They may be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging to a deleted account, or
other similar cases. The files should be repaired so they will not cause problems when
accounts are created in the future, and the cause should be discovered and addressed.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_ungroupowned:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" severity="medium">
              <xccdf-1.2:title>Ensure All Files Are Owned by a User</xccdf-1.2:title>
              <xccdf-1.2:description>If any files are not owned by a user, then the cause of their lack of ownership should be
investigated. Following this, the files should be deleted or assigned to an appropriate user.

Locate the mount points related to local devices by the following command:
<html:pre>$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)</html:pre>

For all mount points listed by the previous command, it is necessary to search for files which
do not belong to a valid user using the following command:
<html:pre>$ sudo find <html:i>MOUNTPOINT</html:i> -xdev -nouser 2&gt;/dev/null</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">For this rule to evaluate centralized user accounts, <html:code>getent</html:code> must be working properly
so that running the command <html:pre>getent passwd</html:pre> returns a list of all users in your organization.
If using the System Security Services Daemon (SSSD), <html:pre>enumerate = true</html:pre> must be configured
in your organization's domain to return a complete list of users</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code>https://access.redhat.com/articles/6999111</html:code>.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R53</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002512</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271781r1092055_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unowned files do not directly imply a security problem, but they are generally a sign that
something is amiss. They may be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging to a deleted account, or
other similar cases. The files should be repaired so they will not cause problems when
accounts are created in the future, and the cause should be discovered and addressed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_files_unowned_by_user:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_fifos" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on FIFOs</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_fifos</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_fifos=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_fifos = 2</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R14</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This parameter is available since Linux Kernel 4.19 and allows to prohibit opening
FIFOs that are not owned by the user in world and group writeable sticky directories.
It avoids unintentional writes to an attacker-controlled FIFO where a program expects
to create the regular file.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_fifos" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of fs.protected_fifos from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_fifos.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "fs.protected_fifos" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for fs.protected_fifos
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w fs.protected_fifos="2"
fi

#
# If fs.protected_fifos present in /etc/sysctl.conf, change value to "2"
#	else, add "fs.protected_fifos = 2" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_fifos")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_fifos\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^fs.protected_fifos\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_fifos" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_fifos

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*fs.protected_fifos.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_fifos

- name: Comment out any occurrences of fs.protected_fifos from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_fifos
    replace: '#fs.protected_fifos'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_fifos

- name: Ensure sysctl fs.protected_fifos is set to 2
  sysctl:
    name: fs.protected_fifos
    value: '2'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_fifos
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_fs_protected_fifos:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_fs_protected_fifos_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_hardlinks</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_hardlinks=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_hardlinks = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00122</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271740r1091932_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By enabling this kernel parameter, users can no longer create soft or hard links to
files which they do not own. Disallowing such hardlinks mitigate vulnerabilities
based on insecure file system accessed by privileged programs, avoiding an
exploitation vector exploiting unsafe use of <html:code>open()</html:code> or <html:code>creat()</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_hardlinks" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of fs.protected_hardlinks from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_hardlinks.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "fs.protected_hardlinks" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for fs.protected_hardlinks
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w fs.protected_hardlinks="1"
fi

#
# If fs.protected_hardlinks present in /etc/sysctl.conf, change value to "1"
#	else, add "fs.protected_hardlinks = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_hardlinks")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_hardlinks\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^fs.protected_hardlinks\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_hardlinks" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002401
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_hardlinks

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*fs.protected_hardlinks.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002401
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_hardlinks

- name: Comment out any occurrences of fs.protected_hardlinks from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_hardlinks
    replace: '#fs.protected_hardlinks'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002401
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_hardlinks

- name: Ensure sysctl fs.protected_hardlinks is set to 1
  sysctl:
    name: fs.protected_hardlinks
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002401
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_hardlinks
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_fs_protected_hardlinks:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_regular" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on Regular files</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_regular</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_regular=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_regular = 2</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R14</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This parameter is available since Linux Kernel 4.19 and allows to prohibit opening
"regular" files that are not owned by the user in world and group writeable sticky
directories. It avoids writes to an attacker-controlled regular file, for example,
when a program expects to create the regular file.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_regular" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of fs.protected_regular from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_regular.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "fs.protected_regular" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for fs.protected_regular
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w fs.protected_regular="2"
fi

#
# If fs.protected_regular present in /etc/sysctl.conf, change value to "2"
#	else, add "fs.protected_regular = 2" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_regular")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_regular\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^fs.protected_regular\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_regular" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_regular

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*fs.protected_regular.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_regular

- name: Comment out any occurrences of fs.protected_regular from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_regular
    replace: '#fs.protected_regular'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_regular

- name: Ensure sysctl fs.protected_regular is set to 2
  sysctl:
    name: fs.protected_regular
    value: '2'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_regular
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_fs_protected_regular:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_fs_protected_regular_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" severity="medium">
              <xccdf-1.2:title>Enable Kernel Parameter to Enforce DAC on Symlinks</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>fs.protected_symlinks</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.protected_symlinks=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.protected_symlinks = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00122</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000312-GPOS-00123</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002402</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271741r1091935_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By enabling this kernel parameter, symbolic links are permitted to be followed
only when outside a sticky world-writable directory, or when the UID of the
link and follower match, or when the directory owner matches the symlink's owner.
Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system
accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of
<html:code>open()</html:code> or <html:code>creat()</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_protected_symlinks" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of fs.protected_symlinks from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*fs.protected_symlinks.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "fs.protected_symlinks" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for fs.protected_symlinks
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w fs.protected_symlinks="1"
fi

#
# If fs.protected_symlinks present in /etc/sysctl.conf, change value to "1"
#	else, add "fs.protected_symlinks = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.protected_symlinks")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.protected_symlinks\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^fs.protected_symlinks\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_protected_symlinks" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002402
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_symlinks

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*fs.protected_symlinks.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002402
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_symlinks

- name: Comment out any occurrences of fs.protected_symlinks from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.protected_symlinks
    replace: '#fs.protected_symlinks'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002402
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_symlinks

- name: Ensure sysctl fs.protected_symlinks is set to 1
  sysctl:
    name: fs.protected_symlinks
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002402
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_protected_symlinks
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_fs_protected_symlinks:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_important_account_files">
              <xccdf-1.2:title>Verify Permissions on Files with Local Account Information and Credentials</xccdf-1.2:title>
              <xccdf-1.2:description>The default restrictive permissions for files which act as
important security databases such as <html:code>passwd</html:code>, <html:code>shadow</html:code>,
<html:code>group</html:code>, and <html:code>gshadow</html:code> files must be maintained.  Many utilities
need read access to the <html:code>passwd</html:code> file in order to function properly, but
read access to the <html:code>shadow</html:code> file allows malicious attacks against system
passwords, and should never be enabled.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/group-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/group-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002533</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271795r1092097_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group-</html:code> file is a backup file of <html:code>/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/group-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002533
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/group-
  file:
    path: /etc/group-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002533
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_backup_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/gshadow-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/gshadow-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002539</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271801r1092115_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow-</html:code> file is a backup of <html:code>/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/gshadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002539
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_groupowner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002539
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_groupowner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_backup_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/passwd-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/passwd-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002545</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271807r1092133_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd-</html:code> file is a backup file of <html:code>/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/passwd-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002545
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd-
  file:
    path: /etc/passwd-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002545
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_backup_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/shadow-</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/shadow-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002551</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271813r1092151_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow-</html:code> file is a backup file of <html:code>/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/shadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002551
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow-
  file:
    path: /etc/shadow-
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002551
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_backup_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/group</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/group</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002532</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271794r1092094_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002532
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/group
  file:
    path: /etc/group
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002532
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/gshadow</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/gshadow</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002538</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271800r1092112_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/gshadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002538
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002538
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/passwd</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/passwd</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002544</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271806r1092130_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002544
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002544
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/shadow</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/shadow</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002550</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271812r1092148_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow</html:code> file stores password hashes. Protection of this file is
critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002550
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002550
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /etc/shells File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/shells</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/shells</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shells</html:code> file contains the list of full pathnames to shells on the system.
Since this file is used by many system programs this file should be protected.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_shells" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /etc/shells
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_shells" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shells
  stat:
    path: /etc/shells
  register: file_exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_groupowner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/shells
  file:
    path: /etc/shells
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_groupowner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_shells:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_shells_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/group-</html:code>, run the command: <html:pre>$ sudo chown root /etc/group- </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002535</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271797r1092103_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group-</html:code> file is a backup file of <html:code>/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/group-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002535
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/group-
  file:
    path: /etc/group-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002535
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_backup_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/gshadow-</html:code>, run the command: <html:pre>$ sudo chown root /etc/gshadow- </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002541</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271803r1092121_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow-</html:code> file is a backup of <html:code>/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/gshadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002541
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_owner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/gshadow-
  file:
    path: /etc/gshadow-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002541
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_owner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_backup_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns Backup passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/passwd-</html:code>, run the command: <html:pre>$ sudo chown root /etc/passwd- </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002547</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271809r1092139_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd-</html:code> file is a backup file of <html:code>/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/passwd-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002547
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd-
  file:
    path: /etc/passwd-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002547
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_backup_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns Backup shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/shadow-</html:code>, run the command: <html:pre>$ sudo chown root /etc/shadow- </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002553</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271815r1092157_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow-</html:code> file is a backup file of <html:code>/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/shadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002553
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow-
  file:
    path: /etc/shadow-
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002553
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_backup_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_group" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns group File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/group</html:code>, run the command: <html:pre>$ sudo chown root /etc/group </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002534</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271796r1092100_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002534
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/group
  file:
    path: /etc/group
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002534
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/gshadow</html:code>, run the command: <html:pre>$ sudo chown root /etc/gshadow </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002540</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271802r1092118_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/gshadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002540
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002540
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns passwd File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/passwd</html:code>, run the command: <html:pre>$ sudo chown root /etc/passwd </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271808r1092136_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002546
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002546
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns shadow File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/shadow</html:code>, run the command: <html:pre>$ sudo chown root /etc/shadow </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002552</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271814r1092154_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002552
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002552
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_shells" severity="medium">
                <xccdf-1.2:title>Verify Who Owns /etc/shells File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/shells</html:code>, run the command:
<html:pre>$ sudo chown root /etc/shells </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shells</html:code> file contains the list of full pathnames to shells on the system.
Since this file is used by many system programs this file should be protected.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_shells" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /etc/shells
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_shells" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shells
  stat:
    path: /etc/shells
  register: file_exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/shells
  file:
    path: /etc/shells
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_owner_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_shells:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_shells_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup group File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/group-</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/group-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002537</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271799r1092109_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group-</html:code> file is a backup file of <html:code>/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/group-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group-
  stat:
    path: /etc/group-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002537
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/group-
  file:
    path: /etc/group-
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002537
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_backup_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/gshadow-</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/gshadow-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002543</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271805r1092127_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow-</html:code> file is a backup of <html:code>/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/gshadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow-
  stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002543
  - NIST-800-53-AC-6 (1)
  - configure_strategy
  - file_permissions_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/gshadow-
  file:
    path: /etc/gshadow-
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002543
  - NIST-800-53-AC-6 (1)
  - configure_strategy
  - file_permissions_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_backup_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup passwd File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/passwd-</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002549</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271811r1092145_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/passwd-</html:code> file is a backup file of <html:code>/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/passwd-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd-
  stat:
    path: /etc/passwd-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002549
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd-
  file:
    path: /etc/passwd-
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002549
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_backup_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on Backup shadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/shadow-</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/shadow-</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002554</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271816r1092160_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow-</html:code> file is a backup file of <html:code>/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/shadow-
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_backup_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow-
  stat:
    path: /etc/shadow-
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002554
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/shadow-
  file:
    path: /etc/shadow-
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002554
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_backup_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" severity="medium">
                <xccdf-1.2:title>Verify Permissions on group File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/group</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/group</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002536</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271798r1092106_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_group" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002536
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/group
  file:
    path: /etc/group
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002536
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_group:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on gshadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/gshadow</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/gshadow</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002542</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271804r1092124_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/gshadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_gshadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002542
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/gshadow
  file:
    path: /etc/gshadow
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002542
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_gshadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" severity="medium">
                <xccdf-1.2:title>Verify Permissions on passwd File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/passwd</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002548</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271810r1092142_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the <html:code>/etc/passwd</html:code> file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_passwd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002548
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd
  file:
    path: /etc/passwd
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002548
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_passwd:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" severity="medium">
                <xccdf-1.2:title>Verify Permissions on shadow File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/shadow</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/shadow</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002555</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271817r1092163_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_shadow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002555
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/shadow
  file:
    path: /etc/shadow
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - DISA-STIG-OL09-00-002555
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_shadow:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shells" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /etc/shells File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/shells</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/shells</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/etc/shells</html:code> file contains the list of full pathnames to shells on the system.
Since this file is used by many system programs this file should be protected.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_shells" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/shells
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_shells" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /etc/shells
  stat:
    path: /etc/shells
  register: file_exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_permissions_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/shells
  file:
    path: /etc/shells
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-3
  - NIST-800-53-MP-2
  - configure_strategy
  - file_permissions_etc_shells
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_shells:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_shells_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_var_log_dir">
              <xccdf-1.2:title>Verify Permissions on Files within /var/log Directory</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /var/log Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/var/log</html:code>, run the command: <html:pre>$ sudo chgrp root /var/log</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000118-CTR-000240</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271818r1092166_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /var/log/ -maxdepth 1 -type d -exec chgrp -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure group owner on /var/log/
  file:
    path: /var/log/
    state: directory
    group: '0'
  tags:
  - DISA-STIG-OL09-00-002560
  - configure_strategy
  - file_groupowner_var_log
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_var_log:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_var_log_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /var/log/messages File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/var/log/messages</html:code>, run the command: <html:pre>$ sudo chgrp root /var/log/messages</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002563</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271821r1092175_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 0 /var/log/messages
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002563
  - configure_strategy
  - file_groupowner_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /var/log/messages
  file:
    path: /var/log/messages
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002563
  - configure_strategy
  - file_groupowner_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_var_log_messages:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_var_log_messages_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /var/log/syslog File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/var/log/syslog</html:code>, run the command: <html:pre>$ sudo chgrp adm /var/log/syslog</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/syslog</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">chgrp 4 /var/log/syslog
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/syslog
  stat:
    path: /var/log/syslog
  register: file_exists
  tags:
  - configure_strategy
  - file_groupowner_var_log_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 4 on /var/log/syslog
  file:
    path: /var/log/syslog
    group: '4'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_var_log_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_var_log_syslog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_var_log_syslog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_var_log" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /var/log Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/var/log</html:code>, run the command: <html:pre>$ sudo chown root /var/log </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000118-CTR-000240</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271819r1092169_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /var/log/ -maxdepth 1 -type d -exec chown -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /var/log/
  file:
    path: /var/log/
    state: directory
    owner: '0'
  tags:
  - DISA-STIG-OL09-00-002561
  - configure_strategy
  - file_owner_var_log
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_var_log:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_var_log_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_var_log_messages" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /var/log/messages File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/var/log/messages</html:code>, run the command: <html:pre>$ sudo chown root /var/log/messages </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002564</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271822r1092178_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">chown 0 /var/log/messages
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002564
  - configure_strategy
  - file_owner_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /var/log/messages
  file:
    path: /var/log/messages
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002564
  - configure_strategy
  - file_owner_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_var_log_messages:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_var_log_messages_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /var/log/syslog File</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/var/log/syslog</html:code>, run the command: <html:pre>$ sudo chown syslog /var/log/syslog </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/syslog</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">chown 104 /var/log/syslog
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/syslog
  stat:
    path: /var/log/syslog
  register: file_exists
  tags:
  - configure_strategy
  - file_owner_var_log_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 104 on /var/log/syslog
  file:
    path: /var/log/syslog
    owner: '104'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_var_log_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_var_log_syslog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_var_log_syslog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /var/log Directory</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/var/log</html:code>, run the command:
<html:pre>$ sudo chmod 0755 /var/log</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000118-CTR-000240</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002562</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271820r1092172_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /var/log/ -maxdepth 1 -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /var/log/ file(s)
  command: 'find -H /var/log/ -maxdepth 1 -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002562
  - configure_strategy
  - file_permissions_var_log
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /var/log/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002562
  - configure_strategy
  - file_permissions_var_log
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_var_log:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /var/log/messages File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/var/log/messages</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /var/log/messages</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002565</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271823r1092181_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/messages</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xwrs,o-xwrt /var/log/messages
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log_messages" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
  - DISA-STIG-OL09-00-002565
  - configure_strategy
  - file_permissions_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /var/log/messages
  file:
    path: /var/log/messages
    mode: u-xs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002565
  - configure_strategy
  - file_permissions_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_var_log_messages:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_var_log_messages_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog" severity="medium">
                <xccdf-1.2:title>Verify Permissions on /var/log/syslog File</xccdf-1.2:title>
                <xccdf-1.2:description>
To properly set the permissions of <html:code>/var/log/syslog</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /var/log/syslog</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The <html:code>/var/log/syslog</html:code> file contains logs of error messages in
the system and should only be accessed by authorized personnel.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">



chmod u-xs,g-xws,o-xwrt /var/log/syslog
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log_syslog" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Test for existence /var/log/syslog
  stat:
    path: /var/log/syslog
  register: file_exists
  tags:
  - configure_strategy
  - file_permissions_var_log_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /var/log/syslog
  file:
    path: /var/log/syslog
    mode: u-xs,g-xws,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_var_log_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_var_log_syslog:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_var_log_syslog_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_within_important_dirs">
              <xccdf-1.2:title>Verify File Permissions Within Some Important Directories</xccdf-1.2:title>
              <xccdf-1.2:description>Some directories contain files whose confidentiality or integrity
is notably important and may also be susceptible to misconfiguration over time, particularly if
unpackaged software is installed. As such,
an argument exists to verify that files' permissions within these directories remain
configured correctly and restrictively.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Directories Have Root Group Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code>/lib/modules</html:code>. All files in these directories should be
group-owned by the <html:code>root</html:code> user. If the  directories, is found to be owned
by a user other than root correct its
ownership with the following command:
<html:pre>$ sudo chgrp root <html:i>DIR</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002520</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271786r1092070_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership of library directories is necessary to protect
the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_group_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /lib/  -type d -exec chgrp -L 0 {} \;
find -H /lib64/  -type d -exec chgrp -L 0 {} \;
find -H /usr/lib/  -type d -exec chgrp -L 0 {} \;
find -H /usr/lib64/  -type d -exec chgrp -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_group_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure group owner on /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    group: '0'
  tags:
  - DISA-STIG-OL09-00-002520
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_group_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /lib64/ recursively
  file:
    path: /lib64/
    state: directory
    recurse: true
    group: '0'
  tags:
  - DISA-STIG-OL09-00-002520
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_group_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /usr/lib/ recursively
  file:
    path: /usr/lib/
    state: directory
    recurse: true
    group: '0'
  tags:
  - DISA-STIG-OL09-00-002520
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_group_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /usr/lib64/ recursively
  file:
    path: /usr/lib64/
    state: directory
    recurse: true
    group: '0'
  tags:
  - DISA-STIG-OL09-00-002520
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_group_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_group_ownership_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_group_ownership_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executable Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description><html:pre>/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin</html:pre>
All these directories should be owned by the <html:code>root</html:code> user.
If any directory <html:i>DIR</html:i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<html:pre>$ sudo chown root <html:i>DIR</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_ownership_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /bin/  -type d -exec chown -L 0 {} \;
find -H /sbin/  -type d -exec chown -L 0 {} \;
find -H /usr/bin/  -type d -exec chown -L 0 {} \;
find -H /usr/sbin/  -type d -exec chown -L 0 {} \;
find -H /usr/local/bin/  -type d -exec chown -L 0 {} \;
find -H /usr/local/sbin/  -type d -exec chown -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_ownership_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /bin/ recursively
  file:
    path: /bin/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - configure_strategy
  - dir_ownership_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /sbin/ recursively
  file:
    path: /sbin/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - configure_strategy
  - dir_ownership_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /usr/bin/ recursively
  file:
    path: /usr/bin/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - configure_strategy
  - dir_ownership_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /usr/sbin/ recursively
  file:
    path: /usr/sbin/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - configure_strategy
  - dir_ownership_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /usr/local/bin/ recursively
  file:
    path: /usr/local/bin/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - configure_strategy
  - dir_ownership_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /usr/local/sbin/ recursively
  file:
    path: /usr/local/sbin/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - configure_strategy
  - dir_ownership_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_ownership_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_ownership_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Directories Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code>/lib/modules</html:code>. All files in these directories should be
owned by the <html:code>root</html:code> user. If the  directories, is found to be owned
by a user other than root correct its
ownership with the following command:
<html:pre>$ sudo chown root <html:i>DIR</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002521</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271787r1092073_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership of library directories is necessary to protect
the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">find -H /lib/  -type d -exec chown -L 0 {} \;
find -H /lib64/  -type d -exec chown -L 0 {} \;
find -H /usr/lib/  -type d -exec chown -L 0 {} \;
find -H /usr/lib64/  -type d -exec chown -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Ensure owner on directory /lib/ recursively
  file:
    path: /lib/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - DISA-STIG-OL09-00-002521
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /lib64/ recursively
  file:
    path: /lib64/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - DISA-STIG-OL09-00-002521
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /usr/lib/ recursively
  file:
    path: /usr/lib/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - DISA-STIG-OL09-00-002521
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /usr/lib64/ recursively
  file:
    path: /usr/lib64/
    state: directory
    recurse: true
    owner: '0'
  tags:
  - DISA-STIG-OL09-00-002521
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_ownership_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_ownership_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_permissions_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executable Directories Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System executables are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin</html:pre>
These directories should not be group-writable or world-writable.
If any directory <html:i>DIR</html:i> in these directories is found to be
group-writable or world-writable, correct its permission with the
following command:
<html:pre>$ sudo chmod go-w <html:i>DIR</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users, as well as system services,
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_permissions_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /sbin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/sbin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/local/bin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

find -H /usr/local/sbin/  -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_permissions_binary_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /bin/ file(s) recursively
  command: 'find -H /bin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /bin/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /sbin/ file(s) recursively
  command: 'find -H /sbin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /sbin/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/bin/ file(s) recursively
  command: 'find -H /usr/bin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/bin/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/sbin/ file(s) recursively
  command: 'find -H /usr/sbin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/sbin/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/local/bin/ file(s) recursively
  command: 'find -H /usr/local/bin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/local/bin/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/local/sbin/ file(s) recursively
  command: 'find -H /usr/local/sbin/  -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/local/sbin/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - configure_strategy
  - dir_permissions_binary_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_permissions_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_permissions_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dir_permissions_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Directories Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library directories, which contain are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <html:code>/lib/modules</html:code>. All sub-directories in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<html:pre>$ sudo chmod go-w <html:i>DIR</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002522</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271788r1092076_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the operating system were to allow any user to make changes to software libraries,
then those changes might be implemented without undergoing the appropriate testing
and approvals that are part of a robust change management process.

This requirement applies to operating systems with software libraries that are accessible
and configurable, as in the case of interpreted languages. Software libraries also include
privileged programs which execute with escalated privileges. Only qualified and authorized
individuals must be allowed to obtain access to information system components for purposes
of initiating changes, including upgrades and modifications.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="dir_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">



find -H /lib/  -perm /g+w,o+w -type d -exec chmod g-w,o-w {} \;

find -H /lib64/  -perm /g+w,o+w -type d -exec chmod g-w,o-w {} \;

find -H /usr/lib/  -perm /g+w,o+w -type d -exec chmod g-w,o-w {} \;

find -H /usr/lib64/  -perm /g+w,o+w -type d -exec chmod g-w,o-w {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="dir_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /lib/ file(s) recursively
  command: 'find -H /lib/  -perm /g+w,o+w  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /lib/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /lib64/ file(s) recursively
  command: 'find -H /lib64/  -perm /g+w,o+w  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /lib64/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/lib/ file(s) recursively
  command: 'find -H /usr/lib/  -perm /g+w,o+w  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/lib/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/lib64/ file(s) recursively
  command: 'find -H /usr/lib64/  -perm /g+w,o+w  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/lib64/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002522
  - NIST-800-53-CM-5
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - dir_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-dir_permissions_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-dir_permissions_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_groupowner_etc_sysctld" severity="medium">
                <xccdf-1.2:title>Verify Group Who Owns /etc/sysctl.d Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/sysctl.d</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/sysctl.d</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The ownership of the /etc/sysctl.d directory by the root group is important
because this directory hosts kernel configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the kernel configuration.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_groupowner_etc_sysctld" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/sysctl.d/ -maxdepth 1 -type d -exec chgrp -L root {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_groupowner_etc_sysctld" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_groupowner_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/sysctl.d/
  file:
    path: /etc/sysctl.d/
    state: directory
    group: root
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_groupowner_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_groupowner_etc_sysctld:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_groupowner_etc_sysctld_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_owner_etc_sysctld" severity="medium">
                <xccdf-1.2:title>Verify User Who Owns /etc/sysctl.d Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the owner of <html:code>/etc/sysctl.d</html:code>, run the command: <html:pre>$ sudo chown root /etc/sysctl.d </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The ownership of the /etc/sysctl.d directory by the root user is important
because this directory hosts kernel configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the kernel configuration.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_owner_etc_sysctld" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/sysctl.d/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_owner_etc_sysctld" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_owner_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/sysctl.d/
  file:
    path: /etc/sysctl.d/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_owner_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_owner_etc_sysctld:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_owner_etc_sysctld_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_etc_sysctld" severity="medium">
                <xccdf-1.2:title>Verify Permissions On /etc/sysctl.d Directory</xccdf-1.2:title>
                <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/sysctl.d</html:code>, run the command: <html:pre>$ sudo chmod 0755 /etc/sysctl.d</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Setting correct permissions on the /etc/sysctl.d directory is important
because this directory hosts kernel configuration. Protection of this
directory is critical for system security. Restricting the permissions
ensures exclusive control of the kernel configuration.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_etc_sysctld" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/sysctl.d/ -maxdepth 1 -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_permissions_etc_sysctld" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_permissions_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/sysctl.d/ file(s)
  command: 'find -H /etc/sysctl.d/ -maxdepth 1 -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_permissions_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/sysctl.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_permissions_etc_sysctld
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_etc_sysctld:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_etc_sysctld_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs" severity="medium">
                <xccdf-1.2:title>Verify that system commands files are group owned by root or a system account</xccdf-1.2:title>
                <xccdf-1.2:description>System commands files are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
</html:pre>
All files in these directories should be owned by the <html:code>root</html:code> group,
or a system account.
If the directory, or any file in these directories, is found to be owned
by a group other than root or a a system account correct its ownership
with the following command:
<html:pre>$ sudo chgrp root <html:i>FILE</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271773r1092031_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the operating system allows any user to make changes to software
libraries, then those changes might be implemented without undergoing the
appropriate testing and approvals that are part of a robust change management
process.
This requirement applies to operating systems with software libraries
that are accessible and configurable, as in the case of interpreted languages.
Software libraries also include privileged programs which execute with
escalated privileges. Only qualified and authorized individuals must be
allowed to obtain access to information system components for purposes
of initiating changes, including upgrades and modifications.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_system_commands_dirs">
for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
do
   find -L $SYSCMDFILES \! -group root -type f -exec chgrp root '{}' \;
done
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_system_commands_dirs" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Retrieve the system command files and set their group ownership to root
  command: find -L {{ item }}  ! -group root -type f -exec chgrp root '{}' \;
  with_items:
  - /bin
  - /sbin
  - /usr/bin
  - /usr/sbin
  - /usr/local/bin
  - /usr/local/sbin
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002504
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - file_groupownership_system_commands_dirs
  - medium_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupownership_system_commands_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupownership_system_commands_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executables Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System executables are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin</html:pre>
All files in these directories should be owned by the <html:code>root</html:code> user.
If any file <html:i>FILE</html:i> in these directories is found
to be owned by a user other than root, correct its ownership with the
following command:
<html:pre>$ sudo chown root <html:i>FILE</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271774r1092034_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users as well as system services,
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_binary_dirs">find /bin/ \
/usr/bin/ \
/usr/local/bin/ \
/sbin/ \
/usr/sbin/ \
/usr/local/sbin/ \
/usr/libexec \
\! -user root -execdir chown root {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_binary_dirs" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Read list of system executables without root ownership
  command: find /bin/ /usr/bin/ /usr/local/bin/ /sbin/ /usr/sbin/ /usr/local/sbin/
    /usr/libexec \! -user root
  register: no_root_system_executables
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002505
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - file_ownership_binary_dirs
  - medium_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set ownership to root of system executables
  file:
    path: '{{ item }}'
    owner: root
  with_items: '{{ no_root_system_executables.stdout_lines }}'
  when: no_root_system_executables.stdout_lines | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-002505
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - file_ownership_binary_dirs
  - medium_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_ownership_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Files Have Root Ownership</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <html:code>/lib/modules</html:code>. All files in these directories should be
owned by the <html:code>root</html:code> user. If the directory, or any file in these
directories, is found to be owned by a user other than root correct its
ownership with the following command:
<html:pre>$ sudo chown root <html:i>FILE</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002524</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271790r1092082_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership is necessary to protect the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">
find  /lib/  -type f ! -uid 0 -regextype posix-extended -regex '^.*$' -exec chown -L 0 {} \;

find  /lib64/  -type f ! -uid 0 -regextype posix-extended -regex '^.*$' -exec chown -L 0 {} \;

find  /usr/lib/  -type f ! -uid 0 -regextype posix-extended -regex '^.*$' -exec chown -L 0 {} \;

find  /usr/lib64/  -type f ! -uid 0 -regextype posix-extended -regex '^.*$' -exec chown -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /lib/ file(s) matching ^.*$ recursively
  command: find -H /lib/  -type f ! -uid 0 -regextype posix-extended -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /lib/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /lib64/ file(s) matching ^.*$ recursively
  command: find -H /lib64/  -type f ! -uid 0 -regextype posix-extended -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /lib64/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/lib/ file(s) matching ^.*$ recursively
  command: find -H /usr/lib/  -type f ! -uid 0 -regextype posix-extended -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /usr/lib/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/lib64/ file(s) matching ^.*$ recursively
  command: find -H /usr/lib64/  -type f ! -uid 0 -regextype posix-extended -regex
    "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /usr/lib64/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002524
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_ownership_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_ownership_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" severity="medium">
                <xccdf-1.2:title>Verify that System Executables Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System executables are stored in the following directories by default:
<html:pre>/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin</html:pre>
All files in these directories should not be group-writable or world-writable.
If any file <html:i>FILE</html:i> in these directories is found
to be group-writable or world-writable, correct its permission with the
following command:
<html:pre>$ sudo chmod go-w <html:i>FILE</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002506</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271775r1092037_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>System binaries are executed by privileged users, as well as system services,
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_binary_dirs">DIRS="/bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin /usr/libexec"
for dirPath in $DIRS; do
	find "$dirPath" -perm /022 -exec chmod go-w '{}' \;
done
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_binary_dirs" complexity="medium" disruption="medium" reboot="false" strategy="restrict">- name: Read list of world and group writable system executables
  ansible.builtin.command: find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin
    /usr/libexec -perm /022 -type f
  register: world_writable_library_files
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002506
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - file_permissions_binary_dirs
  - medium_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Remove world/group writability of system executables
  ansible.builtin.file:
    path: '{{ item }}'
    mode: go-w
    state: file
  with_items: '{{ world_writable_library_files.stdout_lines }}'
  when: world_writable_library_files.stdout_lines | length &gt; 0
  tags:
  - DISA-STIG-OL09-00-002506
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - file_permissions_binary_dirs
  - medium_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_binary_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" severity="medium">
                <xccdf-1.2:title>Verify that Shared Library Files Have Restrictive Permissions</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide shared library files, which are linked to executables
during process load time or run time, are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
Kernel modules, which can be added to the kernel during runtime, are
stored in <html:code>/lib/modules</html:code>. All files in these directories
should not be group-writable or world-writable. If any file in these
directories is found to be group-writable or world-writable, correct
its permission with the following command:
<html:pre>$ sudo chmod go-w <html:i>FILE</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002525</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271791r1092085_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
runtime. Restrictive permissions are necessary to protect the integrity of the system.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">



find  /lib/  -perm /g+w,o+w  -type f -regextype posix-extended -regex '^.*$' -exec chmod g-w,o-w {} \;

find  /lib64/  -perm /g+w,o+w  -type f -regextype posix-extended -regex '^.*$' -exec chmod g-w,o-w {} \;

find  /usr/lib/  -perm /g+w,o+w  -type f -regextype posix-extended -regex '^.*$' -exec chmod g-w,o-w {} \;

find  /usr/lib64/  -perm /g+w,o+w  -type f -regextype posix-extended -regex '^.*$' -exec chmod g-w,o-w {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_library_dirs" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /lib/ file(s) recursively
  command: find -H /lib/  -perm /g+w,o+w  -type f -regextype posix-extended -regex
    "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /lib/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /lib64/ file(s) recursively
  command: find -H /lib64/  -perm /g+w,o+w  -type f -regextype posix-extended -regex
    "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /lib64/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/lib/ file(s) recursively
  command: find -H /usr/lib/  -perm /g+w,o+w  -type f -regextype posix-extended -regex
    "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/lib/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /usr/lib64/ file(s) recursively
  command: find -H /usr/lib64/  -perm /g+w,o+w  -type f -regextype posix-extended
    -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /usr/lib64/ file(s)
  file:
    path: '{{ item }}'
    mode: g-w,o-w
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002525
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_library_dirs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_library_dirs:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files" severity="medium">
                <xccdf-1.2:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</xccdf-1.2:title>
                <xccdf-1.2:description>System-wide library files are stored in the following directories
by default:
<html:pre>/lib
/lib64
/usr/lib
/usr/lib64
</html:pre>
All system-wide shared library files should be protected from unauthorised
access. If any of these files is not group-owned by root, correct its group-owner with
the following command:
<html:pre>$ sudo chgrp root <html:i>FILE</html:i>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001499</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(6).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000259-GPOS-00100</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002523</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271789r1092079_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>If the operating system were to allow any user to make changes to software libraries,
then those changes might be implemented without undergoing the appropriate testing and
approvals that are part of a robust change management process.

This requirement applies to operating systems with software libraries that are
accessible and configurable, as in the case of interpreted languages. Software libraries
also include privileged programs which execute with escalated privileges. Only qualified
and authorized individuals must be allowed to obtain access to information system components
for purposes of initiating changes, including upgrades and modifications.</xccdf-1.2:rationale>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="root_permissions_syslibrary_files" complexity="low" disruption="low" reboot="false" strategy="configure">
find  /lib/  -type f ! -group 0 -regextype posix-extended -regex '^.*$' -exec chgrp -L 0 {} \;

find  /lib64/  -type f ! -group 0 -regextype posix-extended -regex '^.*$' -exec chgrp -L 0 {} \;

find  /usr/lib/  -type f ! -group 0 -regextype posix-extended -regex '^.*$' -exec chgrp -L 0 {} \;

find  /usr/lib64/  -type f ! -group 0 -regextype posix-extended -regex '^.*$' -exec chgrp -L 0 {} \;
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="root_permissions_syslibrary_files" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Find /lib/ file(s) matching ^.*$ recursively
  command: find -H /lib/  -type f ! -group 0 -regextype posix-extended -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Ensure group owner on /lib/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Find /lib64/ file(s) matching ^.*$ recursively
  command: find -H /lib64/  -type f ! -group 0 -regextype posix-extended -regex "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Ensure group owner on /lib64/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Find /usr/lib/ file(s) matching ^.*$ recursively
  command: find -H /usr/lib/  -type f ! -group 0 -regextype posix-extended -regex
    "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Ensure group owner on /usr/lib/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Find /usr/lib64/ file(s) matching ^.*$ recursively
  command: find -H /usr/lib64/  -type f ! -group 0 -regextype posix-extended -regex
    "^.*$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files

- name: Ensure group owner on /usr/lib64/ file(s) matching ^.*$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002523
  - NIST-800-53-CM-5(6)
  - NIST-800-53-CM-5(6).1
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - root_permissions_syslibrary_files
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-root_permissions_syslibrary_files:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-root_permissions_syslibrary_files_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mounting">
            <xccdf-1.2:title>Restrict Dynamic Mounting and Unmounting of
Filesystems</xccdf-1.2:title>
            <xccdf-1.2:description>Linux includes a number of facilities for the automated addition
and removal of filesystems on a running system.  These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
<html:br/>
       <html:br/>
This command can be used to list the types of filesystems that are
available to the currently executing kernel:
<html:pre>$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</html:pre>
If these filesystems are not required then they can be explicitly disabled
in a configuratio file in  <html:code>/etc/modprobe.d</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_autofs_disabled" severity="medium">
              <xccdf-1.2:title>Disable the Automounter</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>autofs</html:code> daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as <html:code>/misc/cd</html:code>.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
possible to configure filesystem mounts statically by editing <html:code>/etc/fstab</html:code>
rather than relying on the automounter.
<html:br/>
        <html:br/>

The <html:code>autofs</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now autofs.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002000</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271639r1091629_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling the automounter permits the administrator to
statically control filesystem mounting through <html:code>/etc/fstab</html:code>.
<html:br/>
        <html:br/>
Additionally, automatically mounting filesystems permits easy introduction of
unknown devices, thereby facilitating malicious activity.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_autofs_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_autofs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q autofs &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'autofs.service'
fi
"$SYSTEMCTL_EXEC" disable 'autofs.service'
"$SYSTEMCTL_EXEC" mask 'autofs.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files autofs.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'autofs.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'autofs.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'autofs.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_autofs_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002000
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_autofs_disabled

- name: Disable the Automounter - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "autofs" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - DISA-STIG-OL09-00-002000
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_autofs_disabled

- name: Disable the Automounter - Ensure autofs.service is Masked
  ansible.builtin.systemd:
    name: autofs.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "autofs" in ansible_facts.packages and ("kernel" in ansible_facts.packages or
    "kernel-uek" in ansible_facts.packages) )
  - service_exists.stdout_lines is search("autofs.service", multiline=True)
  tags:
  - DISA-STIG-OL09-00-002000
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_autofs_disabled

- name: Unit Socket Exists - autofs.socket
  ansible.builtin.command: systemctl -q list-unit-files autofs.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "autofs" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - DISA-STIG-OL09-00-002000
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_autofs_disabled

- name: Disable the Automounter - Disable Socket autofs
  ansible.builtin.systemd:
    name: autofs.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "autofs" in ansible_facts.packages and ("kernel" in ansible_facts.packages or
    "kernel-uek" in ansible_facts.packages) )
  - socket_file_exists.stdout_lines is search("autofs.socket", multiline=True)
  tags:
  - DISA-STIG-OL09-00-002000
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_autofs_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_autofs_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_autofs

class disable_autofs {
  service {'autofs':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_autofs_disabled">
[customizations.services]
masked = ["autofs"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_autofs_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of cramfs</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>cramfs</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/cramfs.conf</html:code>:
<html:pre>install cramfs /bin/false</html:pre>

To configure the system to prevent the <html:code>cramfs</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/cramfs.conf</html:code>:
<html:pre>blacklist cramfs</html:pre>

This effectively prevents usage of this uncommon filesystem.

The <html:code>cramfs</html:code> filesystem type is a compressed read-only
Linux filesystem embedded in small footprint systems. A
<html:code>cramfs</html:code> image can be used without having to first
decompress the image.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000045</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271448r1091056_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystem types reduces the local attack surface
of the server.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_cramfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install cramfs" /etc/modprobe.d/cramfs.conf ; then
	
	sed -i 's#^install cramfs.*#install cramfs /bin/false#g' /etc/modprobe.d/cramfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/cramfs.conf
	echo "install cramfs /bin/false" &gt;&gt; /etc/modprobe.d/cramfs.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist cramfs$" /etc/modprobe.d/cramfs.conf ; then
	echo "blacklist cramfs" &gt;&gt; /etc/modprobe.d/cramfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_cramfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000045
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_cramfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'cramfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/cramfs.conf
    regexp: install\s+cramfs
    line: install cramfs /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000045
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_cramfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'cramfs' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/cramfs.conf
    regexp: ^blacklist cramfs$
    line: blacklist cramfs
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000045
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_cramfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_cramfs_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of squashfs</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>squashfs</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/squashfs.conf</html:code>:
<html:pre>install squashfs /bin/false</html:pre>

To configure the system to prevent the <html:code>squashfs</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/squashfs.conf</html:code>:
<html:pre>blacklist squashfs</html:pre>

This effectively prevents usage of this uncommon filesystem.

The <html:code>squashfs</html:code> filesystem type is a compressed read-only Linux
filesystem embedded in small footprint systems (similar to
<html:code>cramfs</html:code>). A <html:code>squashfs</html:code> image can be used without having
to first decompress the image.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystem types reduces the local attack
surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_squashfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install squashfs" /etc/modprobe.d/squashfs.conf ; then
	
	sed -i 's#^install squashfs.*#install squashfs /bin/false#g' /etc/modprobe.d/squashfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/squashfs.conf
	echo "install squashfs /bin/false" &gt;&gt; /etc/modprobe.d/squashfs.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist squashfs$" /etc/modprobe.d/squashfs.conf ; then
	echo "blacklist squashfs" &gt;&gt; /etc/modprobe.d/squashfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_squashfs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_squashfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'squashfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/squashfs.conf
    regexp: install\s+squashfs
    line: install squashfs /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_squashfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'squashfs' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/squashfs.conf
    regexp: ^blacklist squashfs$
    line: blacklist squashfs
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_squashfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_squashfs_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" severity="low">
              <xccdf-1.2:title>Disable Mounting of udf</xccdf-1.2:title>
              <xccdf-1.2:description>
To configure the system to prevent the <html:code>udf</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/udf.conf</html:code>:
<html:pre>install udf /bin/false</html:pre>

To configure the system to prevent the <html:code>udf</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/udf.conf</html:code>:
<html:pre>blacklist udf</html:pre>

This effectively prevents usage of this uncommon filesystem.

The <html:code>udf</html:code> filesystem type is the universal disk format
used to implement the ISO/IEC 13346 and ECMA-167 specifications.
This is an open vendor filesystem type for data storage on a broad
range of media. This filesystem type is neccessary to support
writing DVDs and newer optical disc formats.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing support for unneeded filesystem types reduces the local
attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_udf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install udf" /etc/modprobe.d/udf.conf ; then
	
	sed -i 's#^install udf.*#install udf /bin/false#g' /etc/modprobe.d/udf.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/udf.conf
	echo "install udf /bin/false" &gt;&gt; /etc/modprobe.d/udf.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist udf$" /etc/modprobe.d/udf.conf ; then
	echo "blacklist udf" &gt;&gt; /etc/modprobe.d/udf.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_udf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_udf_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'udf' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/udf.conf
    regexp: install\s+udf
    line: install udf /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_udf_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'udf' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/udf.conf
    regexp: ^blacklist udf$
    line: blacklist udf
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_udf_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_udf_disabled:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" severity="medium">
              <xccdf-1.2:title>Disable Modprobe Loading of USB Storage Driver</xccdf-1.2:title>
              <xccdf-1.2:description>To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.

To configure the system to prevent the <html:code>usb-storage</html:code>
kernel module from being loaded, add the following line to the file <html:code>/etc/modprobe.d/usb-storage.conf</html:code>:
<html:pre>install usb-storage /bin/false</html:pre>

To configure the system to prevent the <html:code>usb-storage</html:code> from being used,
add the following line to file <html:code>/etc/modprobe.d/usb-storage.conf</html:code>:
<html:pre>blacklist usb-storage</html:pre>

This will prevent the <html:code>modprobe</html:code> program from loading the <html:code>usb-storage</html:code>
module, but will not prevent an administrator (or another program) from using the
<html:code>insmod</html:code> program to load the module manually.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.21</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000778</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003959</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000141-CTR-000315</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.15.SEC-OL1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000047</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002332</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271450r1092466_rule</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271702r1091818_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>USB storage devices such as thumb drives can be used to introduce
malicious software.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_usb-storage_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install usb-storage" /etc/modprobe.d/usb-storage.conf ; then
	
	sed -i 's#^install usb-storage.*#install usb-storage /bin/false#g' /etc/modprobe.d/usb-storage.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/usb-storage.conf
	echo "install usb-storage /bin/false" &gt;&gt; /etc/modprobe.d/usb-storage.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist usb-storage$" /etc/modprobe.d/usb-storage.conf ; then
	echo "blacklist usb-storage" &gt;&gt; /etc/modprobe.d/usb-storage.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_usb-storage_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000047
  - DISA-STIG-OL09-00-002332
  - NIST-800-171-3.1.21
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - disable_strategy
  - kernel_module_usb-storage_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'usb-storage' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/usb-storage.conf
    regexp: install\s+usb-storage
    line: install usb-storage /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000047
  - DISA-STIG-OL09-00-002332
  - NIST-800-171-3.1.21
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - disable_strategy
  - kernel_module_usb-storage_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'usb-storage' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/usb-storage.conf
    regexp: ^blacklist usb-storage$
    line: blacklist usb-storage
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000047
  - DISA-STIG-OL09-00-002332
  - NIST-800-171-3.1.21
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - disable_strategy
  - kernel_module_usb-storage_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_usb-storage_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_partitions">
            <xccdf-1.2:title>Restrict Partition Mount Options</xccdf-1.2:title>
            <xccdf-1.2:description>System partitions can be mounted with certain options
that limit what files on those partitions can do. These options
are set in the <html:code>/etc/fstab</html:code> configuration file, and can be
used to make certain types of malicious behavior more difficult.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#not_bootc_and_not_container"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_removable_partition" type="string">
              <xccdf-1.2:title>Removable Partition</xccdf-1.2:title>
              <xccdf-1.2:description>This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions,
and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from
removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable
partitions that are required on the local system.</xccdf-1.2:description>
              <xccdf-1.2:value selector="dev_cdrom">/dev/cdrom</xccdf-1.2:value>
              <xccdf-1.2:value>/dev/cdrom</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /boot/efi</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/boot/efi</html:code>. The SUID and SGID permissions
should not be required on the boot partition.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot/efi</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002032</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271649r1091659_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from boot partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_efi_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    
        # the mount point /boot/efi has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/boot/efi")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot/efi' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot/efi in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /boot/efi)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /boot/efi  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/boot/efi"; then
        if mountpoint -q "/boot/efi"; then
            mount -o remount --target "/boot/efi"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_efi_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002032
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Check information associated to mountpoint'
  command: findmnt --fstab '/boot/efi'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002032
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002032
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: If /boot/efi not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /boot/efi
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002032
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Make sure nosuid option is part of the to
    /boot/efi options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002032
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot/efi: Ensure /boot/efi is mounted with nosuid option'
  mount:
    path: /boot/efi
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002032
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_efi_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_boot_efi_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_boot_efi_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/boot</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002030</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271647r1091653_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    
        # the mount point /boot has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /boot  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002030
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002030
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002030
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /boot
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002030
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /boot: Make sure nodev option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002030
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /boot: Ensure /boot is mounted with nodev option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002030
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_boot_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_boot_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code>/boot</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/boot</html:code> partition contains the kernel and the bootloader. No
binaries should be executed from this partition after the booting process
finishes.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    
        # the mount point /boot has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /boot  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /boot
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /boot: Make sure noexec option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /boot: Ensure /boot is mounted with noexec option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_boot_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_boot_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /boot</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/boot</html:code>. The SUID and SGID permissions
should not be required on the boot partition.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/boot</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271648r1091656_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from boot partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_boot_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    
        # the mount point /boot has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/boot")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /boot in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /boot)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /boot  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/boot"; then
        if mountpoint -q "/boot"; then
            mount -o remount --target "/boot"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_boot_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002031
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot: Check information associated to mountpoint'
  command: findmnt --fstab '/boot'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002031
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002031
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot: If /boot not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /boot
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002031
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot: Make sure nosuid option is part of the to /boot
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002031
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /boot: Ensure /boot is mounted with nosuid option'
  mount:
    path: /boot
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002031
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_boot_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_boot_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /boot --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_boot_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_boot_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /dev/shm</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent creation of device
files in <html:code>/dev/shm</html:code>. Legitimate character and block devices should
not exist within temporary directories like <html:code>/dev/shm</html:code>.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/dev/shm</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271650r1091662_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_dev_shm_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="tmpfs"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_dev_shm_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002040
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002040
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002040
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /dev/shm
    - tmpfs
    - tmpfs
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002040
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Make sure nodev option is part of the to /dev/shm
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002040
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Ensure /dev/shm is mounted with nodev option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("" |
    length == 0)
  tags:
  - DISA-STIG-OL09-00-002040
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_dev_shm_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /dev/shm</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/dev/shm</html:code>.
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as <html:code>/dev/shm</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/dev/shm</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002041</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271651r1091665_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from world-writable directories
such as <html:code>/dev/shm</html:code> can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_dev_shm_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="tmpfs"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_dev_shm_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002041
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002041
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002041
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: If /dev/shm not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /dev/shm
    - tmpfs
    - tmpfs
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002041
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Make sure noexec option is part of the to
    /dev/shm options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002041
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Ensure /dev/shm is mounted with noexec option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("" |
    length == 0)
  tags:
  - DISA-STIG-OL09-00-002041
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_dev_shm_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /dev/shm</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent execution
of setuid programs in <html:code>/dev/shm</html:code>.  The SUID and SGID permissions should not
be required in these world-writable directories.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/dev/shm</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271652r1094966_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_dev_shm_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="tmpfs"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_dev_shm_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002042
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002042
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002042
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: If /dev/shm not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /dev/shm
    - tmpfs
    - tmpfs
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - ("" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002042
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Make sure nosuid option is part of the to
    /dev/shm options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002042
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Ensure /dev/shm is mounted with nosuid option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("" |
    length == 0)
  tags:
  - DISA-STIG-OL09-00-002042
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_dev_shm_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_home_grpquota" severity="medium">
              <xccdf-1.2:title>Add grpquota Option to /home</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>grpquota</html:code> mount option allows for the filesystem to have disk quotas configured.
Add the <html:code>grpquota</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/home</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The quota options for XFS file systems can only be activated when mounting the partition.
It is not possible to enable them by remounting an already mounted partition. Therefore,
if the desired options were not defined before mounting the partition, dismount and mount
it again to apply the quota options.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="functionality">OVAL looks for partitions whose mount point is a substring of any interactive user's home
directory and validates that grpquota option is there. Because of this, there could be
false negatives when several partitions share a base substring. For example, if there is a
home directory in <html:code>/var/tmp/user1</html:code> and there are partitions mounted in
<html:code>/var</html:code> and <html:code>/var/tmp</html:code>. The grpquota option is only expected in
<html:code>/var/tmp</html:code>, but OVAL will check both.<html:br/>
Bash remediation uses the <html:code>df</html:code> command to find out the partition where the home
directory is mounted. However, if the directory doesn't exist the remediation won't be
applied.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To ensure the availability of disk space on /home, it is important to limit the impact a
single user or group can cause for other users (or the wider system) by intentionally or
accidentally filling up the partition. Quotas can also be applied to inodes for filesystems
where inode exhaustion is a concern.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_home_grpquota" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation (){

    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" $1)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|grpquota)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " $1  defaults,${previous_mount_opts}grpquota 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "grpquota"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,grpquota|" /etc/fstab
    fi

    if mkdir -p "$1"; then
        if mountpoint -q "$1"; then
            mount -o remount --target "$1"
        fi
    fi
}

readarray -t home_directories  &lt; \
    &lt;(awk -F':' '{if ($3&gt;=1000 &amp;&amp; $3!= 65534) print $6}' /etc/passwd )


for home_directory in "${home_directories[@]}"
do
    if [ -d $home_directory ]; then
        fstab_mount_point=$(df $home_directory | awk '/^\/dev/ {print $6}')
        if  ! grep -qP "^/$|^/lib$|^/opt$|^/usr$|^/bin$|^/sbin$|^/boot$|^/dev$|^/proc$" &lt;&lt;&lt; $fstab_mount_point
        then
            perform_remediation "$fstab_mount_point"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_home_grpquota" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_grpquota
  - no_reboot_needed

- name: Add grpquota Option to /home - Initialize variables
  ansible.builtin.set_fact:
    non_allowed_partitions:
    - /
    - /lib
    - /opt
    - /usr
    - /bin
    - /sbin
    - /boot
    - /dev
    - /proc
    home_directories: []
    allowed_mount_point: []
    fstab_mount_point_info: []
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_grpquota
  - no_reboot_needed

- name: Add grpquota Option to /home - Get home directories from passwd
  ansible.builtin.getent:
    database: passwd
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_grpquota
  - no_reboot_needed

- name: Add grpquota Option to /home - Filter home directories based on UID range
  ansible.builtin.set_fact:
    home_directories: '{{ home_directories + [item.data[4]] }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - item.data[4] is defined
  - item.data[2]|int &gt;= 1000
  - item.data[2]|int != 65534
  - item.data[4] not in non_allowed_partitions
  with_items: '{{ ansible_facts.getent_passwd | dict2items(key_name=''user'', value_name=''data'')}}'
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_grpquota
  - no_reboot_needed

- name: Add grpquota Option to /home - Gather mount points
  ansible.builtin.setup:
    filter: ansible_mounts
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_grpquota
  - no_reboot_needed

- name: Add grpquota Option to /home - Ensure mount options for home directories
  block:

  - name: ' Add grpquota Option to /home - Obtain mount point using df and shell'
    ansible.builtin.shell: |
      df {{ item }} | awk '/^\/dev/ {print $6}'
    register: df_output
    with_items: '{{ home_directories }}'

  - name: Add grpquota Option to /home - Set mount point for each home directory
    ansible.builtin.set_fact:
      allowed_mount_point: '{{ allowed_mount_point + [item.stdout_lines[0]] }}'
    with_items: '{{ df_output.results }}'
    when:
    - item.stdout_lines is defined
    - item.stdout_lines | length &gt; 0
    - item.stdout_lines[0] != ""

  - name: Add grpquota Option to /home - Obtain full mount information for allowed
      mount point
    ansible.builtin.set_fact:
      fstab_mount_point_info: '{{ fstab_mount_point_info + [ ansible_mounts | selectattr(''mount'',
        ''equalto'', item) | first ]}}'
    with_items: '{{ allowed_mount_point }}'
    when: allowed_mount_point is defined

  - name: Add grpquota Option to /home - Ensure mount option grpquota is in fstab
      for allowed mount point
    ansible.builtin.mount:
      path: '{{ item.mount }}'
      src: '{{ item.device }}'
      opts: '{{ item.options }},grpquota'
      state: mounted
      fstype: '{{ item.fstype }}'
    with_items: '{{ fstab_mount_point_info }}'
    when:
    - allowed_mount_point is defined
    - item.mount not in non_allowed_partitions
    - '''grpquota'' not in item.options'
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_grpquota
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_home_grpquota:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_home_grpquota_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" severity="unknown">
              <xccdf-1.2:title>Add nodev Option to /home</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/home</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/home</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002070</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271666r1091710_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_home"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_home_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/home" &gt; /dev/null || findmnt --fstab "/home" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /home has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/home")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /home in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /home)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /home  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/home"; then
        if mountpoint -q "/home"; then
            mount -o remount --target "/home"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_home_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002070
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Check information associated to mountpoint'
  command: findmnt --fstab '/home'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002070
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002070
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: If /home not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /home
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002070
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Make sure nodev option is part of the to /home
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002070
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Ensure /home is mounted with nodev option'
  mount:
    path: /home
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002070
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_home_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /home --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_home_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_home_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_home_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /home</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code>/home</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/home</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">OVAL looks for partitions whose mount point is a substring of any interactive user's home
directory and validates that noexec option is there. Because of this, there could be false
negatives when several partitions share a base substring. For example, if there is a home
directory in <html:code>/var/tmp/user1</html:code> and there are partitions mounted in <html:code>/var</html:code> and
<html:code>/var/tmp</html:code>. The noexec option is only expected in <html:code>/var/tmp</html:code>, but OVAL will
check both.<html:br/>
Bash remediation uses the <html:code>df</html:code> command to find out the partition where the home
directory is mounted. However, if the directory doesn't exist the remediation won't be
applied.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271668r1091716_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/home</html:code> directory contains data of individual users. Binaries in
this directory should not be considered as trusted and users should not be
able to execute them.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_home_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation (){

    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" $1)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " $1  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi

    if mkdir -p "$1"; then
        if mountpoint -q "$1"; then
            mount -o remount --target "$1"
        fi
    fi
}

readarray -t home_directories  &lt; \
    &lt;(awk -F':' '{if ($3&gt;=1000 &amp;&amp; $3!= 65534) print $6}' /etc/passwd )


for home_directory in "${home_directories[@]}"
do
    if [ -d $home_directory ]; then
        fstab_mount_point=$(df $home_directory | awk '/^\/dev/ {print $6}')
        if  ! grep -qP "^/$|^/lib$|^/opt$|^/usr$|^/bin$|^/sbin$|^/boot$|^/dev$|^/proc$" &lt;&lt;&lt; $fstab_mount_point
        then
            perform_remediation "$fstab_mount_point"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_home_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002072
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_noexec
  - no_reboot_needed

- name: Add noexec Option to /home - Initialize variables
  ansible.builtin.set_fact:
    non_allowed_partitions:
    - /
    - /lib
    - /opt
    - /usr
    - /bin
    - /sbin
    - /boot
    - /dev
    - /proc
    home_directories: []
    allowed_mount_point: []
    fstab_mount_point_info: []
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002072
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_noexec
  - no_reboot_needed

- name: Add noexec Option to /home - Get home directories from passwd
  ansible.builtin.getent:
    database: passwd
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002072
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_noexec
  - no_reboot_needed

- name: Add noexec Option to /home - Filter home directories based on UID range
  ansible.builtin.set_fact:
    home_directories: '{{ home_directories + [item.data[4]] }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - item.data[4] is defined
  - item.data[2]|int &gt;= 1000
  - item.data[2]|int != 65534
  - item.data[4] not in non_allowed_partitions
  with_items: '{{ ansible_facts.getent_passwd | dict2items(key_name=''user'', value_name=''data'')}}'
  tags:
  - DISA-STIG-OL09-00-002072
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_noexec
  - no_reboot_needed

- name: Add noexec Option to /home - Gather mount points
  ansible.builtin.setup:
    filter: ansible_mounts
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002072
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_noexec
  - no_reboot_needed

- name: Add noexec Option to /home - Ensure mount options for home directories
  block:

  - name: ' Add noexec Option to /home - Obtain mount point using df and shell'
    ansible.builtin.shell: |
      df {{ item }} | awk '/^\/dev/ {print $6}'
    register: df_output
    with_items: '{{ home_directories }}'

  - name: Add noexec Option to /home - Set mount point for each home directory
    ansible.builtin.set_fact:
      allowed_mount_point: '{{ allowed_mount_point + [item.stdout_lines[0]] }}'
    with_items: '{{ df_output.results }}'
    when:
    - item.stdout_lines is defined
    - item.stdout_lines | length &gt; 0
    - item.stdout_lines[0] != ""

  - name: Add noexec Option to /home - Obtain full mount information for allowed mount
      point
    ansible.builtin.set_fact:
      fstab_mount_point_info: '{{ fstab_mount_point_info + [ ansible_mounts | selectattr(''mount'',
        ''equalto'', item) | first ]}}'
    with_items: '{{ allowed_mount_point }}'
    when: allowed_mount_point is defined

  - name: Add noexec Option to /home - Ensure mount option noexec is in fstab for
      allowed mount point
    ansible.builtin.mount:
      path: '{{ item.mount }}'
      src: '{{ item.device }}'
      opts: '{{ item.options }},noexec'
      state: mounted
      fstype: '{{ item.fstype }}'
    with_items: '{{ fstab_mount_point_info }}'
    when:
    - allowed_mount_point is defined
    - item.mount not in non_allowed_partitions
    - '''noexec'' not in item.options'
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002072
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_home_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_home_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /home</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/home</html:code>. The SUID and SGID permissions
should not be required in these user data directories.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/home</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">OVAL looks for partitions whose mount point is a substring of any interactive user's home
directory and validates that noexec option is there. Because of this, there could be false
negatives when several partitions share a base substring. For example, if there is a home
directory in <html:code>/var/tmp/user1</html:code> and there are partitions mounted in <html:code>/var</html:code> and
<html:code>/var/tmp</html:code>. The noexec option is only expected in <html:code>/var/tmp</html:code>, but OVAL will
check both.<html:br/>
Bash remediation uses the <html:code>df</html:code> command to find out the partition where the home
directory is mounted. However, if the directory doesn't exist the remediation won't be
applied.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002071</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271667r1091713_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from user home directory partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_home_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation (){

    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" $1)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " $1  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi

    if mkdir -p "$1"; then
        if mountpoint -q "$1"; then
            mount -o remount --target "$1"
        fi
    fi
}

readarray -t home_directories  &lt; \
    &lt;(awk -F':' '{if ($3&gt;=1000 &amp;&amp; $3!= 65534) print $6}' /etc/passwd )


for home_directory in "${home_directories[@]}"
do
    if [ -d $home_directory ]; then
        fstab_mount_point=$(df $home_directory | awk '/^\/dev/ {print $6}')
        if  ! grep -qP "^/$|^/lib$|^/opt$|^/usr$|^/bin$|^/sbin$|^/boot$|^/dev$|^/proc$" &lt;&lt;&lt; $fstab_mount_point
        then
            perform_remediation "$fstab_mount_point"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_home_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002071
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: Add nosuid Option to /home - Initialize variables
  ansible.builtin.set_fact:
    non_allowed_partitions:
    - /
    - /lib
    - /opt
    - /usr
    - /bin
    - /sbin
    - /boot
    - /dev
    - /proc
    home_directories: []
    allowed_mount_point: []
    fstab_mount_point_info: []
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002071
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: Add nosuid Option to /home - Get home directories from passwd
  ansible.builtin.getent:
    database: passwd
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002071
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: Add nosuid Option to /home - Filter home directories based on UID range
  ansible.builtin.set_fact:
    home_directories: '{{ home_directories + [item.data[4]] }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - item.data[4] is defined
  - item.data[2]|int &gt;= 1000
  - item.data[2]|int != 65534
  - item.data[4] not in non_allowed_partitions
  with_items: '{{ ansible_facts.getent_passwd | dict2items(key_name=''user'', value_name=''data'')}}'
  tags:
  - DISA-STIG-OL09-00-002071
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: Add nosuid Option to /home - Gather mount points
  ansible.builtin.setup:
    filter: ansible_mounts
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002071
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: Add nosuid Option to /home - Ensure mount options for home directories
  block:

  - name: ' Add nosuid Option to /home - Obtain mount point using df and shell'
    ansible.builtin.shell: |
      df {{ item }} | awk '/^\/dev/ {print $6}'
    register: df_output
    with_items: '{{ home_directories }}'

  - name: Add nosuid Option to /home - Set mount point for each home directory
    ansible.builtin.set_fact:
      allowed_mount_point: '{{ allowed_mount_point + [item.stdout_lines[0]] }}'
    with_items: '{{ df_output.results }}'
    when:
    - item.stdout_lines is defined
    - item.stdout_lines | length &gt; 0
    - item.stdout_lines[0] != ""

  - name: Add nosuid Option to /home - Obtain full mount information for allowed mount
      point
    ansible.builtin.set_fact:
      fstab_mount_point_info: '{{ fstab_mount_point_info + [ ansible_mounts | selectattr(''mount'',
        ''equalto'', item) | first ]}}'
    with_items: '{{ allowed_mount_point }}'
    when: allowed_mount_point is defined

  - name: Add nosuid Option to /home - Ensure mount option nosuid is in fstab for
      allowed mount point
    ansible.builtin.mount:
      path: '{{ item.mount }}'
      src: '{{ item.device }}'
      opts: '{{ item.options }},nosuid'
      state: mounted
      fstype: '{{ item.fstype }}'
    with_items: '{{ fstab_mount_point_info }}'
    when:
    - allowed_mount_point is defined
    - item.mount not in non_allowed_partitions
    - '''nosuid'' not in item.options'
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002071
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_home_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_home_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_home_usrquota" severity="medium">
              <xccdf-1.2:title>Add usrquota Option to /home</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>usrquota</html:code> mount option allows for the filesystem to have disk quotas configured.
Add the <html:code>usrquota</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/home</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The quota options for XFS file systems can only be activated when mounting the partition.
It is not possible to enable them by remounting an already mounted partition. Therefore,
if the desired options were not defined before mounting the partition, dismount and mount
it again to apply the quota options.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="functionality">OVAL looks for partitions whose mount point is a substring of any interactive user's home
directory and validates that usrquota option is there. Because of this, there could be
false negatives when several partitions share a base substring. For example, if there is a
home directory in <html:code>/var/tmp/user1</html:code> and there are partitions mounted in
<html:code>/var</html:code> and <html:code>/var/tmp</html:code>. The usrquota option is only expected in
<html:code>/var/tmp</html:code>, but OVAL will check both.<html:br/>
Bash remediation uses the <html:code>df</html:code> command to find out the partition where the home
directory is mounted. However, if the directory doesn't exist the remediation won't be
applied.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To ensure the availability of disk space on /home, it is important to limit the impact a
single user or group can cause for other users (or the wider system) by intentionally or
accidentally filling up the partition. Quotas can also be applied to inodes for filesystems
where inode exhaustion is a concern.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_home_usrquota" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation (){

    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" $1)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|usrquota)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " $1  defaults,${previous_mount_opts}usrquota 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "usrquota"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,usrquota|" /etc/fstab
    fi

    if mkdir -p "$1"; then
        if mountpoint -q "$1"; then
            mount -o remount --target "$1"
        fi
    fi
}

readarray -t home_directories  &lt; \
    &lt;(awk -F':' '{if ($3&gt;=1000 &amp;&amp; $3!= 65534) print $6}' /etc/passwd )


for home_directory in "${home_directories[@]}"
do
    if [ -d $home_directory ]; then
        fstab_mount_point=$(df $home_directory | awk '/^\/dev/ {print $6}')
        if  ! grep -qP "^/$|^/lib$|^/opt$|^/usr$|^/bin$|^/sbin$|^/boot$|^/dev$|^/proc$" &lt;&lt;&lt; $fstab_mount_point
        then
            perform_remediation "$fstab_mount_point"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_home_usrquota" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_usrquota
  - no_reboot_needed

- name: Add usrquota Option to /home - Initialize variables
  ansible.builtin.set_fact:
    non_allowed_partitions:
    - /
    - /lib
    - /opt
    - /usr
    - /bin
    - /sbin
    - /boot
    - /dev
    - /proc
    home_directories: []
    allowed_mount_point: []
    fstab_mount_point_info: []
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_usrquota
  - no_reboot_needed

- name: Add usrquota Option to /home - Get home directories from passwd
  ansible.builtin.getent:
    database: passwd
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_usrquota
  - no_reboot_needed

- name: Add usrquota Option to /home - Filter home directories based on UID range
  ansible.builtin.set_fact:
    home_directories: '{{ home_directories + [item.data[4]] }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - item.data[4] is defined
  - item.data[2]|int &gt;= 1000
  - item.data[2]|int != 65534
  - item.data[4] not in non_allowed_partitions
  with_items: '{{ ansible_facts.getent_passwd | dict2items(key_name=''user'', value_name=''data'')}}'
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_usrquota
  - no_reboot_needed

- name: Add usrquota Option to /home - Gather mount points
  ansible.builtin.setup:
    filter: ansible_mounts
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_usrquota
  - no_reboot_needed

- name: Add usrquota Option to /home - Ensure mount options for home directories
  block:

  - name: ' Add usrquota Option to /home - Obtain mount point using df and shell'
    ansible.builtin.shell: |
      df {{ item }} | awk '/^\/dev/ {print $6}'
    register: df_output
    with_items: '{{ home_directories }}'

  - name: Add usrquota Option to /home - Set mount point for each home directory
    ansible.builtin.set_fact:
      allowed_mount_point: '{{ allowed_mount_point + [item.stdout_lines[0]] }}'
    with_items: '{{ df_output.results }}'
    when:
    - item.stdout_lines is defined
    - item.stdout_lines | length &gt; 0
    - item.stdout_lines[0] != ""

  - name: Add usrquota Option to /home - Obtain full mount information for allowed
      mount point
    ansible.builtin.set_fact:
      fstab_mount_point_info: '{{ fstab_mount_point_info + [ ansible_mounts | selectattr(''mount'',
        ''equalto'', item) | first ]}}'
    with_items: '{{ allowed_mount_point }}'
    when: allowed_mount_point is defined

  - name: Add usrquota Option to /home - Ensure mount option usrquota is in fstab
      for allowed mount point
    ansible.builtin.mount:
      path: '{{ item.mount }}'
      src: '{{ item.device }}'
      opts: '{{ item.options }},usrquota'
      state: mounted
      fstype: '{{ item.fstype }}'
    with_items: '{{ fstab_mount_point_info }}'
    when:
    - allowed_mount_point is defined
    - item.mount not in non_allowed_partitions
    - '''usrquota'' not in item.options'
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - NIST-800-53-CM-6(b)
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_usrquota
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_home_usrquota:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_home_usrquota_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" severity="medium">
              <xccdf-1.2:title>Add nodev Option to Non-Root Local Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option prevents files from being interpreted as
character or block devices. Legitimate character and block devices should
exist only in the <html:code>/dev</html:code> directory on the root partition or within
chroot jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any non-root local partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002080</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271669r1091719_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>nodev</html:code> mount option prevents files from being
interpreted as character or block devices. The only legitimate location
for device files is the <html:code>/dev</html:code> directory located on the root partition.
The only exception to this is chroot jails, for which it is not advised
to set <html:code>nodev</html:code> on these filesystems.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nodev_nonroot_local_partitions"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

MOUNT_OPTION="nodev"
# Create array of local non-root partitions
readarray -t partitions_records &lt; &lt;(findmnt --mtab --raw --evaluate | grep "^/\w" | grep -v "^/proc" | grep "\s/dev/\w")

# Create array of polyinstantiated directories, in case one of them is found in mtab
readarray -t polyinstantiated_dirs &lt; \
    &lt;(grep -oP "^\s*[^#\s]+\s+\S+" /etc/security/namespace.conf | grep -oP "(?&lt;=\s)\S+?(?=/?\$)")


for partition_record in "${partitions_records[@]}"; do
    # Get all important information for fstab
    mount_point="$(echo ${partition_record} | cut -d " " -f1)"
    device="$(echo ${partition_record} | cut -d " " -f2)"
    device_type="$(echo ${partition_record} | cut -d " " -f3)"
    if ! printf '%s\0' "${polyinstantiated_dirs[@]}" | grep -qxzF "$mount_point"; then
        # device and device_type will be used only in case when the device doesn't have fstab record
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" $mount_point)"

        # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
        if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
            # runtime opts without some automatic kernel/userspace-added defaults
            previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                        | sed -E "s/(rw|defaults|seclabel|$MOUNT_OPTION)(,|$)//g;s/,$//")
            [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
            # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
            # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
            fs_type="$device_type"
            if [  "$fs_type" == "iso9660" ] ; then
                previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
            fi
            echo "$device $mount_point $device_type defaults,${previous_mount_opts}$MOUNT_OPTION 0 0" &gt;&gt; /etc/fstab
        # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
        elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "$MOUNT_OPTION"; then
            previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
            sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,$MOUNT_OPTION|" /etc/fstab
        fi
        if mkdir -p "$mount_point"; then
            if mountpoint -q "$mount_point"; then
                mount -o remount --target "$mount_point"
            fi
        fi
    fi
done

# Remediate unmounted /etc/fstab entries
sed -i -E '/nodev/! s;^\s*(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(\S+)(.*)$;\1 \2 \3 \4,nodev \5;' /etc/fstab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nodev_nonroot_local_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002080
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nodev_nonroot_local_partitions
  - no_reboot_needed

- name: 'Add nodev Option to Non-Root Local Partitions: Refresh facts'
  setup:
    gather_subset: mounts
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002080
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nodev_nonroot_local_partitions
  - no_reboot_needed

- name: 'Add nodev Option to Non-Root Local Partitions: Ensure non-root local partitions
    are mounted with nodev option'
  mount:
    path: '{{ item.mount }}'
    src: '{{ item.device }}'
    opts: '{{ item.options }},nodev'
    state: mounted
    fstype: '{{ item.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - item.mount is match('/\w')
  - item.options is not search('nodev')
  with_items:
  - '{{ ansible_facts.mounts }}'
  tags:
  - DISA-STIG-OL09-00-002080
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nodev_nonroot_local_partitions
  - no_reboot_needed

- name: 'Add nodev Option to Non-Root Local Partitions: Ensure non-root local partitions
    are present with nodev option in /etc/fstab'
  ansible.builtin.replace:
    path: /etc/fstab
    regexp: ^\s*(?!#)(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(?!nodev)(\S+)(.*)$
    replace: \1 \2 \3 \4,nodev \5
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002080
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nodev_nonroot_local_partitions
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_nodev_nonroot_local_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" severity="medium">
              <xccdf-1.2:title>Add nodev Option to Removable Media Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option prevents files from being
interpreted as character or block devices.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002021</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271645r1091647_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. An exception to this is chroot jails, and it is
not advised to set <html:code>nodev</html:code> on partitions which contain their root
filesystems.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nodev_removable_partitions" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

var_removable_partition='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>'


device_regex="^\s*$var_removable_partition\s\+"
mount_option="nodev"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nodev_removable_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002021
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nodev_removable_partitions
  - no_reboot_needed
- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission nodev are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,nodev \5
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002021
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nodev_removable_partitions
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_nodev_removable_partitions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_nodev_removable_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" severity="medium">
              <xccdf-1.2:title>Add noexec Option to Removable Media Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option prevents the direct execution of binaries
on the mounted filesystem. Preventing the direct execution of binaries from
removable media (such as a USB key) provides a defense against malicious
software that may be present on such untrusted media.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271644r1091644_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from removable media such as USB keys exposes
the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_noexec_removable_partitions" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

var_removable_partition='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>'


device_regex="^\s*$var_removable_partition\s\+"
mount_option="noexec"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_noexec_removable_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002020
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_noexec_removable_partitions
  - no_reboot_needed
- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission noexec are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,noexec \5
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002020
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_noexec_removable_partitions
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_noexec_removable_partitions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to Removable Media Partitions</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option prevents set-user-identifier (SUID)
and set-group-identifier (SGID) permissions from taking effect. These permissions
allow users to execute binaries with the same permissions as the owner and group
of the file respectively. Users should not be allowed to introduce SUID and SGID
files into the system via partitions mounted from removeable media.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of

    any removable media partitions.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002022</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271646r1091650_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Allowing
users to introduce SUID or SGID binaries from partitions mounted off of
removable media would allow them to introduce their own highly-privileged programs.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nosuid_removable_partitions" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

var_removable_partition='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>'


device_regex="^\s*$var_removable_partition\s\+"
mount_option="nosuid"

if grep -q $device_regex /etc/fstab ; then
    previous_opts=$(grep $device_regex /etc/fstab | awk '{print $4}')
    sed -i "s|\($device_regex.*$previous_opts\)|\1,$mount_option|" /etc/fstab
else
    echo "Not remediating, because there is no record of $var_removable_partition in /etc/fstab" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nosuid_removable_partitions" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002022
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nosuid_removable_partitions
  - no_reboot_needed
- name: XCCDF Value var_removable_partition # promote to variable
  set_fact:
    var_removable_partition: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_removable_partition" use="legacy"/>
  tags:
    - always

- name: Ensure permission nosuid are set on var_removable_partition
  lineinfile:
    path: /etc/fstab
    regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
    backrefs: true
    line: \1 \2 \3 \4,nosuid \5
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-OL09-00-002022
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_nosuid_removable_partitions
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_removable_partition:var:1" value-id="xccdf_org.ssgproject.content_value_var_removable_partition"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_nosuid_removable_partitions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_nosuid_removable_partitions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /opt</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/opt</html:code>. The SUID and SGID permissions
should not be required in this directory.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/opt</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. The
<html:code>/opt</html:code> directory contains additional software packages. Users should
not be able to execute SUID or SGID binaries from this directory.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_opt"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_opt_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/opt" &gt; /dev/null || findmnt --fstab "/opt" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /opt has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/opt")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/opt' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /opt in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /opt)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /opt  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/opt"; then
        if mountpoint -q "/opt"; then
            mount -o remount --target "/opt"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_opt_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Check information associated to mountpoint'
  command: findmnt --fstab '/opt'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: If /opt not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /opt
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Make sure nosuid option is part of the to /opt
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Ensure /opt is mounted with nosuid option'
  mount:
    path: /opt
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_opt_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /opt --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_opt_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_opt_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /srv</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/srv</html:code>. The SUID and SGID permissions
should not be required in this directory.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/srv</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. The
<html:code>/srv</html:code> directory contains files served by various network services such as FTP. Users should
not be able to execute SUID or SGID binaries from this directory.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_srv"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_srv_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/srv" &gt; /dev/null || findmnt --fstab "/srv" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /srv has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/srv")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/srv' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /srv in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /srv)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /srv  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/srv"; then
        if mountpoint -q "/srv"; then
            mount -o remount --target "/srv"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_srv_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_srv_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /srv: Check information associated to mountpoint'
  command: findmnt --fstab '/srv'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/srv" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_srv_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /srv: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/srv" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_srv_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /srv: If /srv not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /srv
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/srv" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_srv_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /srv: Make sure nosuid option is part of the to /srv
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/srv" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_srv_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /srv: Ensure /srv is mounted with nosuid option'
  mount:
    path: /srv
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/srv" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_srv_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_srv_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /srv --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_srv_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_srv_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/tmp</html:code>. Legitimate character and block devices
should not exist within temporary directories like <html:code>/tmp</html:code>.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271653r1091671_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_tmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_tmp_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/tmp" &gt; /dev/null || findmnt --fstab "/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /tmp  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_tmp_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002050
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002050
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002050
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002050
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Make sure nodev option is part of the to /tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002050
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Ensure /tmp is mounted with nodev option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002050
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_tmp_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_tmp_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/tmp</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002051</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271654r1091674_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from world-writable directories
such as <html:code>/tmp</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_tmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_tmp_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/tmp" &gt; /dev/null || findmnt --fstab "/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /tmp  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_tmp_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002051
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002051
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002051
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002051
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Make sure noexec option is part of the to /tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002051
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Ensure /tmp is mounted with noexec option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002051
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_tmp_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_tmp_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/tmp</html:code>. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002052</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271655r1091677_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_tmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_tmp_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/tmp" &gt; /dev/null || findmnt --fstab "/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /tmp  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_tmp_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002052
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002052
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002052
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002052
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Make sure nosuid option is part of the to /tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002052
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Ensure /tmp is mounted with nosuid option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002052
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_tmp_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /tmp --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_tmp_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var/log/audit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var/log/audit</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log/audit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002064</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271660r1091692_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-log-audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_audit_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log/audit" &gt; /dev/null || findmnt --fstab "/var/log/audit" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log/audit has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log/audit  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_audit_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002064
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002064
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002064
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log/audit
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002064
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Make sure nodev option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002064
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Ensure /var/log/audit is mounted with
    nodev option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002064
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_audit_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_log_audit_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var/log/audit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/var/log/audit</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log/audit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002065</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271661r1091695_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from directories containing audit log files
such as <html:code>/var/log/audit</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-log-audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_audit_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log/audit" &gt; /dev/null || findmnt --fstab "/var/log/audit" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log/audit has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log/audit  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_audit_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002065
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002065
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002065
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log/audit
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002065
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Make sure noexec option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002065
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Ensure /var/log/audit is mounted with
    noexec option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002065
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_audit_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_log_audit_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /var/log/audit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var/log/audit</html:code>. The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log/audit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002066</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271662r1091698_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-log-audit"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_audit_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log/audit" &gt; /dev/null || findmnt --fstab "/var/log/audit" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log/audit has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log/audit  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_audit_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002066
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002066
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002066
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log/audit
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002066
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Make sure nosuid option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002066
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Ensure /var/log/audit is mounted with
    nosuid option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002066
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_audit_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log/audit --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_log_audit_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var/log</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var/log</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002061</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271657r1091683_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-log"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log" &gt; /dev/null || findmnt --fstab "/var/log" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002061
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002061
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002061
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: If /var/log not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002061
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Make sure nodev option is part of the to /var/log
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002061
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Ensure /var/log is mounted with nodev option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002061
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_log_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var/log</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/var/log</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002062</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271658r1091686_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from directories containing log files
such as <html:code>/var/log</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-log"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log" &gt; /dev/null || findmnt --fstab "/var/log" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002062
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002062
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002062
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: If /var/log not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002062
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Make sure noexec option is part of the to
    /var/log options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002062
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Ensure /var/log is mounted with noexec option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002062
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_log_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /var/log</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var/log</html:code>. The SUID and SGID permissions
should not be required in directories containing log files.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/log</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002063</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271659r1091689_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-log"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_log_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log" &gt; /dev/null || findmnt --fstab "/var/log" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_log_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002063
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002063
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002063
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: If /var/log not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002063
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Make sure nosuid option is part of the to
    /var/log options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002063
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Ensure /var/log is mounted with nosuid option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002063
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_log_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/log --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_log_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var</html:code>.
Legitimate character and block devices should exist only in
the <html:code>/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002060</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271656r1091680_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var" &gt; /dev/null || findmnt --fstab "/var" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002060
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002060
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002060
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002060
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Make sure nodev option is part of the to /var options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002060
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Ensure /var is mounted with nodev option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002060
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries from being
executed out of <html:code>/var</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>/var</html:code> directory contains variable system data such as logs,
mails and caches. No binaries should be executed from this directory.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var" &gt; /dev/null || findmnt --fstab "/var" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var: Make sure noexec option is part of the to /var
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var: Ensure /var is mounted with noexec option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /var</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var</html:code>. The SUID and SGID permissions
should not be required for this directory.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var" &gt; /dev/null || findmnt --fstab "/var" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Make sure nosuid option is part of the to /var
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Ensure /var is mounted with nosuid option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" severity="medium">
              <xccdf-1.2:title>Add nodev Option to /var/tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nodev</html:code> mount option can be used to prevent device files from
being created in <html:code>/var/tmp</html:code>. Legitimate character and block devices
should not exist within temporary directories like <html:code>/var/tmp</html:code>.
Add the <html:code>nodev</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271663r1091701_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The only legitimate location for device files is the <html:code>/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-tmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_tmp_nodev" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/tmp" &gt; /dev/null || findmnt --fstab "/var/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/tmp  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/tmp"; then
        if mountpoint -q "/var/tmp"; then
            mount -o remount --target "/var/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_tmp_nodev" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002067
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002067
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002067
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: If /var/tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002067
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Make sure nodev option is part of the to /var/tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002067
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Ensure /var/tmp is mounted with nodev option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002067
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_tmp_nodev" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/tmp --mountoptions="nodev"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_tmp_nodev:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_tmp_nodev_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" severity="medium">
              <xccdf-1.2:title>Add noexec Option to /var/tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code>/var/tmp</html:code>.
Add the <html:code>noexec</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002068</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271664r1091704_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing users to execute binaries from world-writable directories
such as <html:code>/var/tmp</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-tmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_tmp_noexec" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/tmp" &gt; /dev/null || findmnt --fstab "/var/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/tmp  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/tmp"; then
        if mountpoint -q "/var/tmp"; then
            mount -o remount --target "/var/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_tmp_noexec" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002068
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002068
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002068
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: If /var/tmp not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002068
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Make sure noexec option is part of the to
    /var/tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002068
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Ensure /var/tmp is mounted with noexec option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002068
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_tmp_noexec" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/tmp --mountoptions="noexec"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_tmp_noexec:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_tmp_noexec_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" severity="medium">
              <xccdf-1.2:title>Add nosuid Option to /var/tmp</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code>/var/tmp</html:code>. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the <html:code>nosuid</html:code> option to the fourth column of
<html:code>/etc/fstab</html:code> for the line which controls mounting of
<html:code>/var/tmp</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002069</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271665r1091707_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#mount_var-tmp"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_var_tmp_nosuid" reboot="false"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/tmp" &gt; /dev/null || findmnt --fstab "/var/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/tmp  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/tmp"; then
        if mountpoint -q "/var/tmp"; then
            mount -o remount --target "/var/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_var_tmp_nosuid" complexity="low" disruption="high" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002069
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - DISA-STIG-OL09-00-002069
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - DISA-STIG-OL09-00-002069
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: If /var/tmp not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - DISA-STIG-OL09-00-002069
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Make sure nosuid option is part of the to
    /var/tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - DISA-STIG-OL09-00-002069
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Ensure /var/tmp is mounted with nosuid option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - DISA-STIG-OL09-00-002069
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="mount_option_var_tmp_nosuid" complexity="low" disruption="high" reboot="false" strategy="enable">
part /var/tmp --mountoptions="nosuid"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_var_tmp_nosuid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_var_tmp_nosuid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_restrictions">
            <xccdf-1.2:title>Restrict Programs from Dangerous Execution Patterns</xccdf-1.2:title>
            <xccdf-1.2:description>The recommendations in this section are designed to
ensure that the system's features to protect against potentially
dangerous program execution are activated.
These protections are applied at the system initialization or
kernel level, and defend against certain types of badly-configured
or compromised programs.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_kernel_unprivileged_bpf_disabled_value" type="number">
              <xccdf-1.2:title>kernel.unprivileged_bpf_disabled</xccdf-1.2:title>
              <xccdf-1.2:description>Prevent unprivileged processes from using the bpf() syscall.</xccdf-1.2:description>
              <xccdf-1.2:value>2</xccdf-1.2:value>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled" severity="medium">
              <xccdf-1.2:title>Disable the uvcvideo module</xccdf-1.2:title>
              <xccdf-1.2:description>If the device contains a camera it should be covered or disabled when not in use.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7 (a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7 (5) (b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000370-GPOS-00155</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Failing to disconnect from collaborative computing devices (i.e., cameras) can result in subsequent compromises of organizational information.
Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure participants actually carry out the disconnect activity without having to go through complex and tedious procedures.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="kernel_module_uvcvideo_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -q -m 1 "^install uvcvideo" /etc/modprobe.d/uvcvideo.conf ; then
	
	sed -i 's#^install uvcvideo.*#install uvcvideo /bin/false#g' /etc/modprobe.d/uvcvideo.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/uvcvideo.conf
	echo "install uvcvideo /bin/false" &gt;&gt; /etc/modprobe.d/uvcvideo.conf
fi

if ! LC_ALL=C grep -q -m 1 "^blacklist uvcvideo$" /etc/modprobe.d/uvcvideo.conf ; then
	echo "blacklist uvcvideo" &gt;&gt; /etc/modprobe.d/uvcvideo.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="kernel_module_uvcvideo_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-7 (5) (b)
  - NIST-800-53-CM-7 (a)
  - disable_strategy
  - kernel_module_uvcvideo_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'uvcvideo' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/uvcvideo.conf
    regexp: install\s+uvcvideo
    line: install uvcvideo /bin/false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-7 (5) (b)
  - NIST-800-53-CM-7 (a)
  - disable_strategy
  - kernel_module_uvcvideo_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'uvcvideo' is blacklisted
  lineinfile:
    create: true
    dest: /etc/modprobe.d/uvcvideo.conf
    regexp: ^blacklist uvcvideo$
    line: blacklist uvcvideo
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-7 (5) (b)
  - NIST-800-53-CM-7 (a)
  - disable_strategy
  - kernel_module_uvcvideo_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-kernel_module_uvcvideo_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-kernel_module_uvcvideo_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" severity="medium">
              <xccdf-1.2:title>Disable storing core dumps</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.core_pattern</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.core_pattern=|/bin/false</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.core_pattern = |/bin/false</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002380</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271728r1091896_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_core_pattern" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.core_pattern.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.core_pattern" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.core_pattern
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.core_pattern="|/bin/false"
fi

#
# If kernel.core_pattern present in /etc/sysctl.conf, change value to "|/bin/false"
#	else, add "kernel.core_pattern = |/bin/false" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.core_pattern")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "|/bin/false"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.core_pattern\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.core_pattern\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_core_pattern" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002380
  - NIST-800-53-SC-7(10)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.core_pattern.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002380
  - NIST-800-53-SC-7(10)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern

- name: Comment out any occurrences of kernel.core_pattern from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.core_pattern
    replace: '#kernel.core_pattern'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002380
  - NIST-800-53-SC-7(10)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern

- name: Ensure sysctl kernel.core_pattern is set to |/bin/false
  sysctl:
    name: kernel.core_pattern
    value: '|/bin/false'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002380
  - NIST-800-53-SC-7(10)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_core_pattern:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_core_pattern_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern_empty_string" severity="medium">
              <xccdf-1.2:title>Disable storing core dumps</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>kernel.core_pattern</html:code> option specifies the core dumpfile pattern
name. It can be set to an empty string. In this case, the kernel
behaves differently based on another related option. If
<html:code>kernel.core_uses_pid</html:code> is set to <html:code>1</html:code>, then a file named as
<html:code>.PID</html:code> (where <html:code>PID</html:code> is process ID of the crashed process) is
created in the working directory. If <html:code>kernel.core_uses_pid</html:code> is set to
<html:code>0</html:code>, no coredump is saved.
To set the runtime status of the <html:code>kernel.core_pattern</html:code> kernel parameter,
run the following command:
<html:pre>$ sudo sysctl -w kernel.core_pattern=</html:pre>

To make sure that the setting is persistent,
add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>:
<html:pre>kernel.core_pattern = </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_uses_pid"/>
              <xccdf-1.2:conflicts idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_core_pattern_empty_string" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf files
for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf; do

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.core_pattern.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.core_pattern" matches to preserve user data
      sed -i "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set runtime for kernel.core_pattern
#
/sbin/sysctl -q -n -w kernel.core_pattern=""

#
# If kernel.core_pattern present in /etc/sysctl.conf, change value to empty
#	else, add "kernel.core_pattern =" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.core_pattern")

# shellcheck disable=SC2059
printf -v formatted_output "%s=" "$stripped_key"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.core_pattern\\&gt;" "/etc/sysctl.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    "${sed_command[@]}" "s/^kernel.core_pattern\\&gt;.*/$escaped_formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline

    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/sysctl.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_core_pattern_empty_string" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern_empty_string

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    contains: ^[\s]*kernel.core_pattern.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern_empty_string

- name: Comment out any occurrences of kernel.core_pattern from /etc/sysctl.d/*.conf
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.core_pattern
    replace: '#kernel.core_pattern'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern_empty_string

- name: Comment out any occurrences of kernel.core_pattern with value from /etc/sysctl.conf
    files
  replace:
    path: /etc/sysctl.conf
    regexp: ^[\s]*kernel.core_pattern([ \t]*=[ \t]*\S+)
    replace: '#kernel.core_pattern\1'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern_empty_string

- name: Ensure sysctl kernel.core_pattern is set to empty
  sysctl:
    name: kernel.core_pattern
    value: ' '
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_pattern_empty_string
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_core_pattern_empty_string:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_core_pattern_empty_string_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_uses_pid" severity="medium">
              <xccdf-1.2:title>Configure file name of core dumps</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.core_uses_pid</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.core_uses_pid=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.core_uses_pid = 0</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The default coredump filename is <html:code>core</html:code>. By setting
<html:code>core_uses_pid</html:code> to <html:code>1</html:code>, the coredump filename becomes
<html:code>core.PID</html:code>. If <html:code>core_pattern</html:code> does not include
<html:code>%p</html:code> (default does not) and <html:code>core_uses_pid</html:code> is set, then
<html:code>.PID</html:code> will be appended to the filename.
When combined with <html:code>kernel.core_pattern = ""</html:code> configuration, it
is ensured that no core dumps are generated and also no confusing error
messages are printed by a shell.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_core_uses_pid" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.core_uses_pid from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.core_uses_pid.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.core_uses_pid" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.core_uses_pid
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.core_uses_pid="0"
fi

#
# If kernel.core_uses_pid present in /etc/sysctl.conf, change value to "0"
#	else, add "kernel.core_uses_pid = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.core_uses_pid")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.core_uses_pid\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.core_uses_pid\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_core_uses_pid" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_uses_pid

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.core_uses_pid.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_uses_pid

- name: Comment out any occurrences of kernel.core_uses_pid from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.core_uses_pid
    replace: '#kernel.core_uses_pid'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_uses_pid

- name: Ensure sysctl kernel.core_uses_pid is set to 0
  sysctl:
    name: kernel.core_uses_pid
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_core_uses_pid
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_core_uses_pid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_core_uses_pid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" severity="low">
              <xccdf-1.2:title>Restrict Access to Kernel Message Buffer</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.dmesg_restrict</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.dmesg_restrict=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.dmesg_restrict = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001082</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000243-CTR-000600</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002406</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271745r1091947_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unprivileged access to the kernel syslog can expose sensitive kernel
address information.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_dmesg_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.dmesg_restrict from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.dmesg_restrict.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.dmesg_restrict" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.dmesg_restrict
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.dmesg_restrict="1"
fi

#
# If kernel.dmesg_restrict present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.dmesg_restrict = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.dmesg_restrict")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.dmesg_restrict\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.dmesg_restrict\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_dmesg_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002406
  - NIST-800-171-3.1.5
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_dmesg_restrict

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.dmesg_restrict.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002406
  - NIST-800-171-3.1.5
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_dmesg_restrict

- name: Comment out any occurrences of kernel.dmesg_restrict from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.dmesg_restrict
    replace: '#kernel.dmesg_restrict'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002406
  - NIST-800-171-3.1.5
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_dmesg_restrict

- name: Ensure sysctl kernel.dmesg_restrict is set to 1
  sysctl:
    name: kernel.dmesg_restrict
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002406
  - NIST-800-171-3.1.5
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_dmesg_restrict
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_dmesg_restrict:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" severity="medium">
              <xccdf-1.2:title>Disable Kernel Image Loading</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.kexec_load_disabled</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.kexec_load_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.kexec_load_disabled = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003992</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002428</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271766r1092010_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling kexec_load allows greater control of the kernel memory.
It makes it impossible to load another kernel image after it has been disabled.
</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_kexec_load_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.kexec_load_disabled from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.kexec_load_disabled.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.kexec_load_disabled" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.kexec_load_disabled
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.kexec_load_disabled="1"
fi

#
# If kernel.kexec_load_disabled present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.kexec_load_disabled = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.kexec_load_disabled")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.kexec_load_disabled\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.kexec_load_disabled\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_kexec_load_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002428
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kexec_load_disabled

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.kexec_load_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002428
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kexec_load_disabled

- name: Comment out any occurrences of kernel.kexec_load_disabled from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.kexec_load_disabled
    replace: '#kernel.kexec_load_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002428
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kexec_load_disabled

- name: Ensure sysctl kernel.kexec_load_disabled is set to 1
  sysctl:
    name: kernel.kexec_load_disabled
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002428
  - NIST-800-53-CM-6
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kexec_load_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled" severity="medium">
              <xccdf-1.2:title>Disable loading and unloading of kernel modules</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.modules_disabled</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.modules_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.modules_disabled = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with remediation. Remediating this rule during the installation process disrupts the install and boot process.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R10</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Malicious kernel modules can have a significant impact on system security and
availability. Disabling loading of kernel modules prevents this threat. Note
that once this option has been set, it cannot be reverted without doing a
system reboot. Make sure that all needed kernel modules are loaded before
setting this option.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_modules_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_modules_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_panic_on_oops" severity="medium">
              <xccdf-1.2:title>Kernel panic on oops</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.panic_on_oops</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.panic_on_oops=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.panic_on_oops = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">The system may start to panic when it normally wouldn't. A non-catastrophic error that
would have allowed the system to continue operating will now result in a panic.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:rationale>An attacker trying to exploit the kernel may trigger kernel OOPSes,
panicking the system will impede them from continuing.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_panic_on_oops" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.panic_on_oops from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.panic_on_oops.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.panic_on_oops" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.panic_on_oops
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.panic_on_oops="1"
fi

#
# If kernel.panic_on_oops present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.panic_on_oops = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.panic_on_oops")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.panic_on_oops\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.panic_on_oops\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_panic_on_oops" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_panic_on_oops

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.panic_on_oops.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_panic_on_oops

- name: Comment out any occurrences of kernel.panic_on_oops from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.panic_on_oops
    replace: '#kernel.panic_on_oops'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_panic_on_oops

- name: Ensure sysctl kernel.panic_on_oops is set to 1
  sysctl:
    name: kernel.panic_on_oops
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_panic_on_oops
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_panic_on_oops:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_panic_on_oops_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_cpu_time_max_percent" severity="medium">
              <xccdf-1.2:title>Limit CPU consumption of the Perf system</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.perf_cpu_time_max_percent</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.perf_cpu_time_max_percent=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.perf_cpu_time_max_percent = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>kernel.perf_cpu_time_max_percent</html:code> configures a treshold of
maximum percentile of CPU that can be used by Perf system. Restricting usage
of <html:code>Perf</html:code> system decreases risk of potential availability problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_perf_cpu_time_max_percent" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.perf_cpu_time_max_percent from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.perf_cpu_time_max_percent.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.perf_cpu_time_max_percent" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.perf_cpu_time_max_percent
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.perf_cpu_time_max_percent="1"
fi

#
# If kernel.perf_cpu_time_max_percent present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.perf_cpu_time_max_percent = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.perf_cpu_time_max_percent")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.perf_cpu_time_max_percent\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.perf_cpu_time_max_percent\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_perf_cpu_time_max_percent" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_cpu_time_max_percent

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.perf_cpu_time_max_percent.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_cpu_time_max_percent

- name: Comment out any occurrences of kernel.perf_cpu_time_max_percent from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.perf_cpu_time_max_percent
    replace: '#kernel.perf_cpu_time_max_percent'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_cpu_time_max_percent

- name: Ensure sysctl kernel.perf_cpu_time_max_percent is set to 1
  sysctl:
    name: kernel.perf_cpu_time_max_percent
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_cpu_time_max_percent
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_max_sample_rate" severity="medium">
              <xccdf-1.2:title>Limit sampling frequency of the Perf system</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.perf_event_max_sample_rate</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.perf_event_max_sample_rate=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.perf_event_max_sample_rate = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>kernel.perf_event_max_sample_rate</html:code> parameter configures maximum
frequency of collecting of samples for the Perf system. It is expressed in
samples per second. Restricting usage of <html:code>Perf</html:code> system decreases risk
of potential availability problems.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_perf_event_max_sample_rate" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.perf_event_max_sample_rate from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.perf_event_max_sample_rate.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.perf_event_max_sample_rate" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.perf_event_max_sample_rate
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.perf_event_max_sample_rate="1"
fi

#
# If kernel.perf_event_max_sample_rate present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.perf_event_max_sample_rate = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.perf_event_max_sample_rate")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.perf_event_max_sample_rate\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.perf_event_max_sample_rate\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_perf_event_max_sample_rate" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_event_max_sample_rate

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.perf_event_max_sample_rate.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_event_max_sample_rate

- name: Comment out any occurrences of kernel.perf_event_max_sample_rate from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.perf_event_max_sample_rate
    replace: '#kernel.perf_event_max_sample_rate'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_event_max_sample_rate

- name: Ensure sysctl kernel.perf_event_max_sample_rate is set to 1
  sysctl:
    name: kernel.perf_event_max_sample_rate
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_perf_event_max_sample_rate
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" severity="low">
              <xccdf-1.2:title>Disallow kernel profiling by unprivileged users</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.perf_event_paranoid</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.perf_event_paranoid=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.perf_event_paranoid = 2</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001082</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000243-CTR-000600</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002407</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271746r1091950_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Kernel profiling can reveal sensitive information about kernel behaviour.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_perf_event_paranoid" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.perf_event_paranoid from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.perf_event_paranoid.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.perf_event_paranoid" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.perf_event_paranoid
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.perf_event_paranoid="2"
fi

#
# If kernel.perf_event_paranoid present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.perf_event_paranoid = 2" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.perf_event_paranoid")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.perf_event_paranoid\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.perf_event_paranoid\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_perf_event_paranoid" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002407
  - NIST-800-53-AC-6
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_perf_event_paranoid

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.perf_event_paranoid.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002407
  - NIST-800-53-AC-6
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_perf_event_paranoid

- name: Comment out any occurrences of kernel.perf_event_paranoid from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.perf_event_paranoid
    replace: '#kernel.perf_event_paranoid'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002407
  - NIST-800-53-AC-6
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_perf_event_paranoid

- name: Ensure sysctl kernel.perf_event_paranoid is set to 2
  sysctl:
    name: kernel.perf_event_paranoid
    value: '2'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002407
  - NIST-800-53-AC-6
  - disable_strategy
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
  - sysctl_kernel_perf_event_paranoid
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_perf_event_paranoid_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_pid_max" severity="medium">
              <xccdf-1.2:title>Configure maximum number of process identifiers</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.pid_max</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.pid_max=65536</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.pid_max = 65536</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>kernel.pid_max</html:code> parameter configures upper limit on process
identifiers (PID). If this number is not high enough, it might happen that
forking of new processes is not possible, because all available PIDs are
exhausted. Increasing this number enhances availability.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_pid_max" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.pid_max from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.pid_max.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.pid_max" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.pid_max
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.pid_max="65536"
fi

#
# If kernel.pid_max present in /etc/sysctl.conf, change value to "65536"
#	else, add "kernel.pid_max = 65536" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.pid_max")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "65536"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.pid_max\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.pid_max\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_pid_max" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_pid_max

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.pid_max.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_pid_max

- name: Comment out any occurrences of kernel.pid_max from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.pid_max
    replace: '#kernel.pid_max'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_pid_max

- name: Ensure sysctl kernel.pid_max is set to 65536
  sysctl:
    name: kernel.pid_max
    value: '65536'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_pid_max
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_pid_max:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_pid_max_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_sysrq" severity="medium">
              <xccdf-1.2:title>Disallow magic SysRq key</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.sysrq</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.sysrq=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.sysrq = 0</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The Magic SysRq key allows sending certain commands directly to the running
kernel. It can dump various system and process information, potentially
revealing sensitive information. It can also reboot or shutdown the machine,
disturbing its availability.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_sysrq" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.sysrq from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.sysrq.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.sysrq" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.sysrq
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.sysrq="0"
fi

#
# If kernel.sysrq present in /etc/sysctl.conf, change value to "0"
#	else, add "kernel.sysrq = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.sysrq")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.sysrq\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.sysrq\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_sysrq" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_sysrq

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.sysrq.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_sysrq

- name: Comment out any occurrences of kernel.sysrq from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.sysrq
    replace: '#kernel.sysrq'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_sysrq

- name: Ensure sysctl kernel.sysrq is set to 0
  sysctl:
    name: kernel.sysrq
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_sysrq
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_sysrq:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_sysrq_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" severity="medium">
              <xccdf-1.2:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.unprivileged_bpf_disabled</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.unprivileged_bpf_disabled = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001082</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002409</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271748r1091956_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Loading and accessing the packet filters programs and maps using the bpf()
syscall has the potential of revealing sensitive information about the kernel state.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_unprivileged_bpf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.unprivileged_bpf_disabled from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.unprivileged_bpf_disabled.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.unprivileged_bpf_disabled" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.unprivileged_bpf_disabled
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.unprivileged_bpf_disabled="1"
fi

#
# If kernel.unprivileged_bpf_disabled present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.unprivileged_bpf_disabled = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.unprivileged_bpf_disabled")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.unprivileged_bpf_disabled\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.unprivileged_bpf_disabled\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_unprivileged_bpf_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002409
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.unprivileged_bpf_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002409
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled

- name: Comment out any occurrences of kernel.unprivileged_bpf_disabled from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.unprivileged_bpf_disabled
    replace: '#kernel.unprivileged_bpf_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002409
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled

- name: Ensure sysctl kernel.unprivileged_bpf_disabled is set to 1
  sysctl:
    name: kernel.unprivileged_bpf_disabled
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002409
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled_accept_default" severity="medium">
              <xccdf-1.2:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</xccdf-1.2:title>
              <xccdf-1.2:description>To prevent unprivileged processes from using the <html:code>bpf()</html:code> syscall
the <html:code>kernel.unprivileged_bpf_disabled</html:code> kernel parameter must
be set to <html:code>1</html:code> or <html:code>2</html:code>.

Writing <html:code>1</html:code> to this entry will disable unprivileged calls to <html:code>bpf()</html:code>; once
disabled, calling <html:code>bpf()</html:code> without <html:code>CAP_SYS_ADMIN</html:code> or <html:code>CAP_BPF</html:code> will return <html:code>-EPERM</html:code>.
Once set to <html:code>1</html:code>, this can't be cleared from the running kernel anymore.

To set the runtime status of the <html:code>kernel.unprivileged_bpf_disabled</html:code> kernel parameter,
run the following command:
<html:pre>$ sudo sysctl -w kernel.unprivileged_bpf_disabled=1</html:pre>

To make sure that the setting is persistent,
add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>:
<html:pre>kernel.unprivileged_bpf_disabled = 1</html:pre>

Writing <html:code>2</html:code> to this entry will also disable unprivileged calls to <html:code>bpf()</html:code>,
however, an admin can still change this setting later on, if needed, by
writing <html:code>0</html:code> or <html:code>1</html:code> to this entry.

To set the runtime status of the <html:code>kernel.unprivileged_bpf_disabled</html:code> kernel parameter,
run the following command:
<html:pre>$ sudo sysctl -w kernel.unprivileged_bpf_disabled=2</html:pre>

To make sure that the setting is persistent,
add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>:
<html:pre>kernel.unprivileged_bpf_disabled = 2</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Loading and accessing the packet filters programs and maps using the bpf()
syscall has the potential of revealing sensitive information about the kernel state.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_unprivileged_bpf_disabled_accept_default" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.unprivileged_bpf_disabled from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.unprivileged_bpf_disabled.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.unprivileged_bpf_disabled" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_kernel_unprivileged_bpf_disabled_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_unprivileged_bpf_disabled_value" use="legacy"/>'


#
# Set runtime for kernel.unprivileged_bpf_disabled
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.unprivileged_bpf_disabled="$sysctl_kernel_unprivileged_bpf_disabled_value"
fi

#
# If kernel.unprivileged_bpf_disabled present in /etc/sysctl.conf, change value to appropriate value
#	else, add "kernel.unprivileged_bpf_disabled = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.unprivileged_bpf_disabled")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_kernel_unprivileged_bpf_disabled_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.unprivileged_bpf_disabled\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.unprivileged_bpf_disabled\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_unprivileged_bpf_disabled_accept_default" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled_accept_default

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.unprivileged_bpf_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled_accept_default

- name: Comment out any occurrences of kernel.unprivileged_bpf_disabled from config
    files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.unprivileged_bpf_disabled
    replace: '#kernel.unprivileged_bpf_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled_accept_default
- name: XCCDF Value sysctl_kernel_unprivileged_bpf_disabled_value # promote to variable
  set_fact:
    sysctl_kernel_unprivileged_bpf_disabled_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_unprivileged_bpf_disabled_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl kernel.unprivileged_bpf_disabled is set
  sysctl:
    name: kernel.unprivileged_bpf_disabled
    value: '{{ sysctl_kernel_unprivileged_bpf_disabled_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_unprivileged_bpf_disabled_accept_default
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" severity="medium">
              <xccdf-1.2:title>Restrict usage of ptrace to descendant processes</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.yama.ptrace_scope</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.yama.ptrace_scope=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.yama.ptrace_scope = 1</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001082</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002410</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271749r1091959_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user. Like this, the attacker can steal
sensitive information from the target processes (e.g. SSH sessions, web browser, ...)
without any additional assistance from the user (i.e. without resorting to phishing).
</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_yama_ptrace_scope" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.yama.ptrace_scope from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.yama.ptrace_scope.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.yama.ptrace_scope" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.yama.ptrace_scope
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.yama.ptrace_scope="1"
fi

#
# If kernel.yama.ptrace_scope present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.yama.ptrace_scope = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.yama.ptrace_scope")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.yama.ptrace_scope\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.yama.ptrace_scope\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_yama_ptrace_scope" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002410
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.yama.ptrace_scope.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002410
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Comment out any occurrences of kernel.yama.ptrace_scope from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.yama.ptrace_scope
    replace: '#kernel.yama.ptrace_scope'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002410
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Ensure sysctl kernel.yama.ptrace_scope is set to 1
  sysctl:
    name: kernel.yama.ptrace_scope
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002410
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" severity="medium">
              <xccdf-1.2:title>Harden the operation of the BPF just-in-time compiler</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>net.core.bpf_jit_harden</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w net.core.bpf_jit_harden=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>net.core.bpf_jit_harden = 2</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271768r1092016_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When hardened, the extended Berkeley Packet Filter just-in-time compiler
will randomize any kernel addresses in the BPF programs and maps,
and will not expose the JIT addresses in <html:code>/proc/kallsyms</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_net_core_bpf_jit_harden" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of net.core.bpf_jit_harden from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.core.bpf_jit_harden.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.core.bpf_jit_harden" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.core.bpf_jit_harden
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w net.core.bpf_jit_harden="2"
fi

#
# If net.core.bpf_jit_harden present in /etc/sysctl.conf, change value to "2"
#	else, add "net.core.bpf_jit_harden = 2" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.core.bpf_jit_harden")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.core.bpf_jit_harden\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.core.bpf_jit_harden\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_net_core_bpf_jit_harden" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002430
  - NIST-800-53-CM-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_core_bpf_jit_harden

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*net.core.bpf_jit_harden.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002430
  - NIST-800-53-CM-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_core_bpf_jit_harden

- name: Comment out any occurrences of net.core.bpf_jit_harden from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*net.core.bpf_jit_harden
    replace: '#net.core.bpf_jit_harden'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002430
  - NIST-800-53-CM-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_core_bpf_jit_harden

- name: Ensure sysctl net.core.bpf_jit_harden is set to 2
  sysctl:
    name: net.core.bpf_jit_harden
    value: '2'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002430
  - NIST-800-53-CM-6
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_core_bpf_jit_harden
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_net_core_bpf_jit_harden_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" severity="medium">
              <xccdf-1.2:title>Disable the use of user namespaces</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>user.max_user_namespaces</html:code> kernel parameter,
run the following command:
<html:pre>$ sudo sysctl -w user.max_user_namespaces=0</html:pre>

To make sure that the setting is persistent,
add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>:
<html:pre>user.max_user_namespaces = 0</html:pre>
When containers are deployed on the machine, the value should be set
to large non-zero value.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as to host Linux Containers,
it is expected that <html:code>user.max_user_namespaces</html:code> will be enabled.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002370</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271727r1091893_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or system objectives.
These unnecessary capabilities or services are often overlooked and therefore may remain unsecured.
They increase the risk to the platform by providing additional attack vectors.
User namespaces are used primarily for Linux containers. The value 0
disallows the use of user namespaces.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_user_max_user_namespaces" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of user.max_user_namespaces from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*user.max_user_namespaces.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "user.max_user_namespaces" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for user.max_user_namespaces
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w user.max_user_namespaces="0"
fi

#
# If user.max_user_namespaces present in /etc/sysctl.conf, change value to "0"
#	else, add "user.max_user_namespaces = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^user.max_user_namespaces")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^user.max_user_namespaces\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^user.max_user_namespaces\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_user_max_user_namespaces" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002370
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_user_max_user_namespaces

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*user.max_user_namespaces.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002370
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_user_max_user_namespaces

- name: Comment out any occurrences of user.max_user_namespaces from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*user.max_user_namespaces
    replace: '#user.max_user_namespaces'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002370
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_user_max_user_namespaces

- name: Ensure sysctl user.max_user_namespaces is set to 0
  sysctl:
    name: user.max_user_namespaces
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002370
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_user_max_user_namespaces
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_user_max_user_namespaces:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_user_max_user_namespaces_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_vm_mmap_min_addr" severity="medium">
              <xccdf-1.2:title>Prevent applications from mapping low portion of virtual memory</xccdf-1.2:title>
              <xccdf-1.2:description>To set the runtime status of the <html:code>vm.mmap_min_addr</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w vm.mmap_min_addr=65536</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>vm.mmap_min_addr = 65536</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>vm.mmap_min_addr</html:code> parameter specifies the minimum virtual
address that a process is allowed to mmap. Allowing a process to mmap low
portion of virtual memory can have security implications such as such as
heightened risk of kernel null pointer dereference defects.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_vm_mmap_min_addr" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of vm.mmap_min_addr from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*vm.mmap_min_addr.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "vm.mmap_min_addr" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for vm.mmap_min_addr
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w vm.mmap_min_addr="65536"
fi

#
# If vm.mmap_min_addr present in /etc/sysctl.conf, change value to "65536"
#	else, add "vm.mmap_min_addr = 65536" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^vm.mmap_min_addr")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "65536"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^vm.mmap_min_addr\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^vm.mmap_min_addr\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_vm_mmap_min_addr" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_vm_mmap_min_addr

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*vm.mmap_min_addr.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_vm_mmap_min_addr

- name: Comment out any occurrences of vm.mmap_min_addr from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*vm.mmap_min_addr
    replace: '#vm.mmap_min_addr'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_vm_mmap_min_addr

- name: Ensure sysctl vm.mmap_min_addr is set to 65536
  sysctl:
    name: vm.mmap_min_addr
    value: '65536'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_vm_mmap_min_addr
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_vm_mmap_min_addr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_vm_mmap_min_addr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_coredumps">
              <xccdf-1.2:title>Disable Core Dumps</xccdf-1.2:title>
              <xccdf-1.2:description>A core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
<html:br/>
        <html:br/>
Once a hard limit is set in <html:code>/etc/security/limits.conf</html:code>, or
to a file within the <html:code>/etc/security/limits.d/</html:code> directory, a
user cannot increase that limit within his or her own session. If access
to core dumps is required, consider restricting them to only
certain users or groups. See the <html:code>limits.conf</html:code> man page for more
information.
<html:br/>
        <html:br/>
The core dumps of setuid programs are further protected. The
<html:code>sysctl</html:code> variable <html:code>fs.suid_dumpable</html:code> controls whether
the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" severity="medium">
                <xccdf-1.2:title>Disable acquiring, saving, and processing core dumps</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>systemd-coredump.socket</html:code> unit is a socket activation of
the <html:code>systemd-coredump@.service</html:code> which processes core dumps.
By masking the unit, core dump processing is disabled.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002384</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271732r1091908_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers trying to debug problems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_systemd-coredump_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SOCKET_NAME="systemd-coredump.socket"
SYSTEMCTL_EXEC='/usr/bin/systemctl'

if "$SYSTEMCTL_EXEC" -q list-unit-files --type socket | grep -q "$SOCKET_NAME"; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop "$SOCKET_NAME"
    fi
    "$SYSTEMCTL_EXEC" mask "$SOCKET_NAME"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_systemd-coredump_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002384
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-coredump_disabled

- name: Disable acquiring, saving, and processing core dumps - Collect systemd Socket
    Units Present in the System
  ansible.builtin.command:
    cmd: systemctl -q list-unit-files --type socket
  register: result_systemd_unit_files
  changed_when: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002384
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-coredump_disabled

- name: Disable acquiring, saving, and processing core dumps - Ensure systemd-coredump.socket
    is Masked
  ansible.builtin.systemd:
    name: systemd-coredump.socket
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - result_systemd_unit_files.stdout_lines is search("systemd-coredump.socket")
  tags:
  - DISA-STIG-OL09-00-002384
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-coredump_disabled
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_systemd-coredump_disabled:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_systemd-coredump_disabled_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" severity="medium">
                <xccdf-1.2:title>Disable core dump backtraces</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>ProcessSizeMax</html:code> option in <html:code>[Coredump]</html:code> section
of <html:code>/etc/systemd/coredump.conf</html:code>
specifies the maximum size in bytes of a core which will be processed.
Core dumps exceeding this size may be stored, but the backtrace will not
be generated.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the <html:code>/etc/systemd/coredump.conf</html:code> file
does not already contain the <html:code>[Coredump]</html:code> section,
the value will not be configured correctly.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002381</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271729r1091899_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.

Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_systemd"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="coredump_disable_backtraces" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q systemd; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/systemd/coredump.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*ProcessSizeMax" "$f"; then

            sed -i "s/ProcessSizeMax[^(\n)]*/ProcessSizeMax=0/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then

            sed -i "/[[:space:]]*\[Coredump\]/a ProcessSizeMax=0" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/systemd/coredump.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[Coredump]\nProcessSizeMax=0" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="coredump_disable_backtraces" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002381
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set 'ProcessSizeMax' to '0' in the [Coredump] section of '/etc/systemd/coredump.conf'
  ini_file:
    path: /etc/systemd/coredump.conf
    section: Coredump
    option: ProcessSizeMax
    value: '0'
    create: true
    mode: 420
  when: '"systemd" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002381
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-coredump_disable_backtraces:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_coredump_disable_storage" severity="medium">
                <xccdf-1.2:title>Disable storing core dump</xccdf-1.2:title>
                <xccdf-1.2:description>The <html:code>Storage</html:code> option in <html:code>[Coredump]</html:code> sectionof <html:code>/etc/systemd/coredump.conf</html:code>
can be set to <html:code>none</html:code> to disable storing core dumps permanently.</xccdf-1.2:description>
                <xccdf-1.2:warning category="general">If the <html:code>/etc/systemd/coredump.conf</html:code> file
does not already contain the <html:code>[Coredump]</html:code> section,
the value will not be configured correctly.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002382</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271730r1091902_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_systemd"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="coredump_disable_storage" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q systemd; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/systemd/coredump.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*Storage" "$f"; then

            sed -i "s/Storage[^(\n)]*/Storage=none/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then

            sed -i "/[[:space:]]*\[Coredump\]/a Storage=none" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/systemd/coredump.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[Coredump]\nStorage=none" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="coredump_disable_storage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002382
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set 'Storage' to 'none' in the [Coredump] section of '/etc/systemd/coredump.conf'
  ini_file:
    path: /etc/systemd/coredump.conf
    section: Coredump
    option: Storage
    value: none
    create: true
    mode: 420
  when: '"systemd" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002382
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-coredump_disable_storage:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_users_coredumps" severity="medium">
                <xccdf-1.2:title>Disable Core Dumps for All Users</xccdf-1.2:title>
                <xccdf-1.2:description>To disable core dumps for all users, add the following line to
<html:code>/etc/security/limits.conf</html:code>, or to a file within the
<html:code>/etc/security/limits.d/</html:code> directory:
<html:pre>*     hard   core    0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002383</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271731r1091905_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#package_pam"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disable_users_coredumps"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

SECURITY_LIMITS_FILE="/etc/security/limits.conf"

if grep -qE '^\s*\*\s+hard\s+core' $SECURITY_LIMITS_FILE; then
        sed -ri 's/(hard\s+core\s+)[[:digit:]]+/\1 0/' $SECURITY_LIMITS_FILE
else
        echo "*     hard   core    0" &gt;&gt; $SECURITY_LIMITS_FILE
fi

if ls /etc/security/limits.d/*.conf &gt; /dev/null; then
        sed -ri '/^\s*\*\s+hard\s+core/d' /etc/security/limits.d/*.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_users_coredumps" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002383
  - NIST-800-53-CM-6
  - NIST-800-53-SC-7(10)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_users_coredumps
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable core dumps with limits
  lineinfile:
    dest: /etc/security/limits.conf
    regexp: ^[^#].*core
    line: '*        hard       core      0'
    create: true
  when: '"pam" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002383
  - NIST-800-53-CM-6
  - NIST-800-53-SC-7(10)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_users_coredumps
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-disable_users_coredumps:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" severity="medium">
                <xccdf-1.2:title>Disable Core Dumps for SUID programs</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>fs.suid_dumpable</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w fs.suid_dumpable=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>fs.suid_dumpable = 0</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-11(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The core dump of a setuid program is more likely to contain
sensitive data, as the program itself runs with greater privileges than the
user who initiated execution of the program.  Disabling the ability for any
setuid program to write a core file decreases the risk of unauthorized access
of such data.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_fs_suid_dumpable" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of fs.suid_dumpable from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*fs.suid_dumpable.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "fs.suid_dumpable" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for fs.suid_dumpable
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w fs.suid_dumpable="0"
fi

#
# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0"
#	else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^fs.suid_dumpable")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.suid_dumpable\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^fs.suid_dumpable\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_fs_suid_dumpable" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_suid_dumpable

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*fs.suid_dumpable.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_suid_dumpable

- name: Comment out any occurrences of fs.suid_dumpable from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*fs.suid_dumpable
    replace: '#fs.suid_dumpable'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_suid_dumpable

- name: Ensure sysctl fs.suid_dumpable is set to 0
  sysctl:
    name: fs.suid_dumpable
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-SI-11(a)
  - NIST-800-53-SI-11(b)
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_fs_suid_dumpable
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_fs_suid_dumpable:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_enable_execshield_settings">
              <xccdf-1.2:title>Enable ExecShield</xccdf-1.2:title>
              <xccdf-1.2:description>ExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default
on 32-bit systems and controlled through <html:code>sysctl</html:code> variables 
<html:code>kernel.exec-shield</html:code> and <html:code>kernel.randomize_va_space</html:code>. On the latest
64-bit systems, <html:code>kernel.exec-shield</html:code> cannot be enabled or disabled with 
<html:code>sysctl</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" type="number">
                <xccdf-1.2:title>kernel.kptr_restrict</xccdf-1.2:title>
                <xccdf-1.2:description>Configure exposition of kernel pointer addresses </xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" severity="medium">
                <xccdf-1.2:title>Enable ExecShield via sysctl</xccdf-1.2:title>
                <xccdf-1.2:description>By default on Oracle Linux 9 64-bit systems, ExecShield is
enabled and can only be disabled if the hardware does not support
ExecShield or is disabled in <html:code>/etc/default/grub</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271760r1091992_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>ExecShield uses the segmentation feature on all x86 systems to prevent
execution in memory higher than a certain address. It writes an address as
a limit in the code segment descriptor, to control where code can be
executed, on a per-process basis. When the kernel places a process's memory
regions such as the stack and heap higher than this address, the hardware
prevents execution in that address range. This is enabled by default on the
latest Red Hat and Fedora systems if supported by the hardware.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_exec_shield" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

grubby --update-kernel=ALL --remove-args=noexec

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_exec_shield" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002422
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --remove-args="noexec"
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002422
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_exec_shield:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" severity="medium">
                <xccdf-1.2:title>Restrict Exposed Kernel Pointer Addresses Access</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.kptr_restrict</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.kptr_restrict=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/>
         </html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.kptr_restrict = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/>
         </html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001082</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-002-5 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-002-5 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-005-6 R1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-005-6 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-005-6 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R8.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-009-6 R.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-009-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(5)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002408</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271747r1091953_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Exposing kernel pointers (through procfs or <html:code>seq_printf()</html:code>) exposes kernel
writeable structures which may contain functions pointers. If a write vulnerability
occurs in the kernel, allowing write access to any of this structure, the kernel can
be compromised. This option disallow any program without the CAP_SYSLOG capability
to get the addresses of kernel pointers by replacing them with 0.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_kptr_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.kptr_restrict from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.kptr_restrict.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.kptr_restrict" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_kernel_kptr_restrict_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/>'


#
# Set runtime for kernel.kptr_restrict
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.kptr_restrict="$sysctl_kernel_kptr_restrict_value"
fi

#
# If kernel.kptr_restrict present in /etc/sysctl.conf, change value to appropriate value
#	else, add "kernel.kptr_restrict = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.kptr_restrict")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_kernel_kptr_restrict_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.kptr_restrict\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.kptr_restrict\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_kptr_restrict" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002408
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - NIST-800-53-SC-30(5)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kptr_restrict

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.kptr_restrict.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002408
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - NIST-800-53-SC-30(5)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kptr_restrict

- name: Comment out any occurrences of kernel.kptr_restrict from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.kptr_restrict
    replace: '#kernel.kptr_restrict'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002408
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - NIST-800-53-SC-30(5)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kptr_restrict
- name: XCCDF Value sysctl_kernel_kptr_restrict_value # promote to variable
  set_fact:
    sysctl_kernel_kptr_restrict_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sysctl_kernel_kptr_restrict_value" use="legacy"/>
  tags:
    - always

- name: Ensure sysctl kernel.kptr_restrict is set
  sysctl:
    name: kernel.kptr_restrict
    value: '{{ sysctl_kernel_kptr_restrict_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002408
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - NIST-800-53-SC-30(5)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_kptr_restrict
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_kptr_restrict:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" severity="medium">
                <xccdf-1.2:title>Enable Randomized Layout of Virtual Address Space</xccdf-1.2:title>
                <xccdf-1.2:description>To set the runtime status of the <html:code>kernel.randomize_va_space</html:code> kernel parameter, run the following command: <html:pre>$ sudo sysctl -w kernel.randomize_va_space=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code>/etc/sysctl.d</html:code>: <html:pre>kernel.randomize_va_space = 2</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-002-5 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-002-5 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-005-6 R1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-005-6 R1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-005-6 R1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R8.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-009-6 R.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-009-6 R4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000450-CTR-001105</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002423</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271761r1091995_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Address space layout randomization (ASLR) makes it more difficult for an
attacker to predict the location of attack code they have introduced into a
process's address space during an attempt at exploitation. Additionally,
ASLR makes it more difficult for an attacker to know the location of
existing code in order to re-purpose it using return oriented programming
(ROP) techniques.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#system_with_kernel"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sysctl_kernel_randomize_va_space" complexity="low" disruption="medium" reboot="true" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Comment out any occurrences of kernel.randomize_va_space from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.randomize_va_space.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.randomize_va_space" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.randomize_va_space
#
if [[ "$OSCAP_BOOTC_BUILD" != "YES" ]] ; then
    /sbin/sysctl -q -n -w kernel.randomize_va_space="2"
fi

#
# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.randomize_va_space")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.randomize_va_space\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.randomize_va_space\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sysctl_kernel_randomize_va_space" complexity="low" disruption="medium" reboot="true" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002423
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    contains: ^[\s]*kernel.randomize_va_space.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002423
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Comment out any occurrences of kernel.randomize_va_space from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.randomize_va_space
    replace: '#kernel.randomize_va_space'
  loop: '{{ find_sysctl_d.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002423
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Ensure sysctl kernel.randomize_va_space is set to 2
  sysctl:
    name: kernel.randomize_va_space
    value: '2'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002423
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sysctl_kernel_randomize_va_space:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_enable_nx">
              <xccdf-1.2:title>Enable Execute Disable (XD) or No Execute (NX) Support on
x86 Systems</xccdf-1.2:title>
              <xccdf-1.2:description>Recent processors in the x86 family support the
ability to prevent code execution on a per memory page basis.
Generically and on AMD processors, this ability is called No
Execute (NX), while on Intel processors it is called Execute
Disable (XD). This ability can help prevent exploitation of buffer
overflow vulnerabilities and should be activated whenever possible.
Extra steps must be taken to ensure that this protection is
enabled, particularly on 32-bit x86 systems. Other processors, such
as Itanium and POWER, have included such support since inception
and the standard kernel for those platforms supports the
feature. This is enabled by default on the latest Oracle Linux, Red Hat and
Fedora systems if supported by the hardware.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions" severity="medium">
                <xccdf-1.2:title>Enable NX or XD Support in the BIOS</xccdf-1.2:title>
                <xccdf-1.2:description>Reboot the system and enter the BIOS or Setup configuration menu.
Navigate the BIOS configuration menu and make sure that the option is enabled. The setting may be located
under a Security section. Look for Execute Disable (XD) on Intel-based systems and No Execute (NX)
on AMD-based systems.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-39</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000450-CTR-001105</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Computers with the ability to prevent this type of code execution frequently put an option in the BIOS that will
allow users to turn the feature on or off at will.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#not_aarch64_arch_and_not_ppc64le_arch_and_system_with_kernel"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-bios_enable_execution_restrictions:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-bios_enable_execution_restrictions_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_poisoning">
              <xccdf-1.2:title>Memory Poisoning</xccdf-1.2:title>
              <xccdf-1.2:description>Memory Poisoning consists of writing a special value to uninitialized or freed memory.
Poisoning can be used as a mechanism to prevent leak of information and detection of
corrupted memory.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_slub_debug_options" type="string" interactive="true">
                <xccdf-1.2:title>slub_debug - debug options</xccdf-1.2:title>
                <xccdf-1.2:description>Defines the debug options to use in <html:code>slub_debug</html:code> kernel command line argument.</xccdf-1.2:description>
                <xccdf-1.2:value>P</xccdf-1.2:value>
                <xccdf-1.2:value selector="F">F</xccdf-1.2:value>
                <xccdf-1.2:value selector="Z">Z</xccdf-1.2:value>
                <xccdf-1.2:value selector="P">P</xccdf-1.2:value>
                <xccdf-1.2:value selector="FZ">FZ</xccdf-1.2:value>
                <xccdf-1.2:value selector="FZP">FZP</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" severity="medium">
                <xccdf-1.2:title>Enable page allocator poisoning</xccdf-1.2:title>
                <xccdf-1.2:description>To enable poisoning of free pages,
add the argument <html:code>page_poison=1</html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>page_poison=1</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>page_poison=1</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... page_poison=1 ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="page_poison=1"</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002394</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271738r1092600_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Poisoning writes an arbitrary value to freed pages, so any modification or
reference to that page after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#grub2"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_page_poison_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q grub2-common; }; then

expected_value="1"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "page_poison" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"page_poison=[^\"]*\"(.*]\s*)/\1\"page_poison=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"page_poison=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-page_poison.toml"
    fi
else

    grubby --update-kernel=ALL --args=page_poison=1

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_page_poison_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002394
  - NIST-800-53-CM-6(a)
  - grub2_page_poison_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="page_poison=1"
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002394
  - NIST-800-53-CM-6(a)
  - grub2_page_poison_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_page_poison_argument">[customizations.kernel]
append = "page_poison=1"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_page_poison_argument:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_page_poison_argument_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" severity="medium">
                <xccdf-1.2:title>Enable SLUB/SLAB allocator poisoning</xccdf-1.2:title>
                <xccdf-1.2:description>To enable poisoning of SLUB/SLAB objects,
add the argument <html:code>slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>
         </html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>
         </html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>
         </html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/> ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>"</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002824</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00192</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002390</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271734r1091914_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Poisoning writes an arbitrary value to freed objects, so any modification or
reference to that object after being freed or before being initialized will be
detected and prevented.
This prevents many types of use-after-free vulnerabilities at little performance cost.
Also prevents leak of data and detection of corrupted memory.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#grub2"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_slub_debug_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q grub2-common; }; then

var_slub_debug_options='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>'

expected_value="$var_slub_debug_options"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "slub_debug" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"slub_debug=[^\"]*\"(.*]\s*)/\1\"slub_debug=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"slub_debug=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-slub_debug.toml"
    fi
else

    grubby --update-kernel=ALL --args=slub_debug=$var_slub_debug_options

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_slub_debug_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002390
  - NIST-800-53-CM-6(a)
  - grub2_slub_debug_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_slub_debug_options # promote to variable
  set_fact:
    var_slub_debug_options: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>
  tags:
    - always

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="slub_debug={{ var_slub_debug_options
    }}"
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002390
  - NIST-800-53-CM-6(a)
  - grub2_slub_debug_argument
  - low_disruption
  - medium_complexity
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_slub_debug_argument">[customizations.kernel]
append = "slub_debug=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_slub_debug_options" use="legacy"/>"
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_slub_debug_options:var:1" value-id="xccdf_org.ssgproject.content_value_var_slub_debug_options"/>
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_slub_debug_argument:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_slub_debug_argument_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_selinux">
          <xccdf-1.2:title>SELinux</xccdf-1.2:title>
          <xccdf-1.2:description>SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<html:br/>
      <html:br/>
The default SELinux policy, as configured on Oracle Linux 9, has been
sufficiently developed and debugged that it should be usable on
almost any system with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<html:br/>
      <html:br/>
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Oracle Linux 9 system, unless that
system has unusual requirements which make a stronger policy
appropriate.

For more information on SELinux, see <html:b><html:a href="https://docs.oracle.com/en/operating-systems/oracle-linux/selinux/">https://docs.oracle.com/en/operating-systems/oracle-linux/selinux/</html:a></html:b>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinux_policy_name" type="string">
            <xccdf-1.2:title>SELinux policy</xccdf-1.2:title>
            <xccdf-1.2:description>Type of policy in use. Possible values are:
<html:br/>targeted - Only targeted network daemons are protected.
<html:br/>strict - Full SELinux protection.
<html:br/>mls - Multiple levels of security</xccdf-1.2:description>
            <xccdf-1.2:value>targeted</xccdf-1.2:value>
            <xccdf-1.2:value selector="mls">mls</xccdf-1.2:value>
            <xccdf-1.2:value selector="targeted">targeted</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinux_state" type="string">
            <xccdf-1.2:title>SELinux state</xccdf-1.2:title>
            <xccdf-1.2:description>enforcing - SELinux security policy is enforced.
<html:br/>permissive - SELinux prints warnings instead of enforcing.
<html:br/>disabled - SELinux is fully disabled.</xccdf-1.2:description>
            <xccdf-1.2:value>enforcing</xccdf-1.2:value>
            <xccdf-1.2:value selector="disabled">disabled</xccdf-1.2:value>
            <xccdf-1.2:value selector="enforcing">enforcing</xccdf-1.2:value>
            <xccdf-1.2:value selector="permissive">permissive</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_libselinux_installed" severity="high">
            <xccdf-1.2:title>Install libselinux Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>libselinux</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install libselinux</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.

The <html:code>libselinux</html:code> package contains the core library of the Security-enhanced Linux system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "libselinux" ; then
    yum install -y "libselinux"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_libselinux_installed

- name: Ensure libselinux is installed
  package:
    name: libselinux
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_libselinux_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_libselinux

class install_libselinux {
  package { 'libselinux':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_libselinux_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=libselinux
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_libselinux_installed">
[[packages]]
name = "libselinux"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_libselinux_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_policycoreutils-python-utils_installed" severity="medium">
            <xccdf-1.2:title>Install policycoreutils-python-utils package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>policycoreutils-python-utils</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install policycoreutils-python-utils</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271468r1091116_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This package is required to operate and manage an SELinux environment and its policies.
It provides utilities such as semanage, audit2allow, audit2why, chcat and sandbox.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_policycoreutils-python-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "policycoreutils-python-utils" ; then
    yum install -y "policycoreutils-python-utils"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_policycoreutils-python-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000210
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_policycoreutils-python-utils_installed

- name: Ensure policycoreutils-python-utils is installed
  package:
    name: policycoreutils-python-utils
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000210
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_policycoreutils-python-utils_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_policycoreutils-python-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_policycoreutils-python-utils

class install_policycoreutils-python-utils {
  package { 'policycoreutils-python-utils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_policycoreutils-python-utils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=policycoreutils-python-utils
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_policycoreutils-python-utils_installed">
[[packages]]
name = "policycoreutils-python-utils"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_policycoreutils-python-utils_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_policycoreutils-python-utils_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" severity="low">
            <xccdf-1.2:title>Install policycoreutils Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>policycoreutils</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install policycoreutils</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000200</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271467r1091113_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.
The Security-enhanced Linux kernel contains new architectural components originally
developed to improve security of the Flask operating system. These architectural components
provide general support for the enforcement of many kinds of mandatory access control
policies, including those based on the concepts of Type Enforcement, Role-based Access
Control, and Multi-level Security.

<html:code>policycoreutils</html:code> contains the policy core utilities that are required for
basic operation of an SELinux-enabled system. These utilities include <html:code>load_policy</html:code>
to load SELinux policies, <html:code>setfiles</html:code> to label filesystems, <html:code>newrole</html:code> to
switch roles, and so on.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "policycoreutils" ; then
    yum install -y "policycoreutils"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000200
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_policycoreutils_installed

- name: Ensure policycoreutils is installed
  package:
    name: policycoreutils
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000200
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_policycoreutils_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_policycoreutils

class install_policycoreutils {
  package { 'policycoreutils':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_policycoreutils_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=policycoreutils
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_policycoreutils_installed">
[[packages]]
name = "policycoreutils"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_policycoreutils_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_setroubleshoot-plugins_removed" severity="low">
            <xccdf-1.2:title>Uninstall setroubleshoot-plugins Package</xccdf-1.2:title>
            <xccdf-1.2:description>The SETroubleshoot plugins are used to analyze SELinux AVC data. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code>setroubleshoot-plugins</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase setroubleshoot-plugins</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R49</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The SETroubleshoot service is an unnecessary daemon to
have running on a server.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# CAUTION: This remediation script will remove setroubleshoot-plugins
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot-plugins. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot-plugins" ; then
yum remove -y "setroubleshoot-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot-plugins_removed

- name: Ensure setroubleshoot-plugins is removed
  package:
    name: setroubleshoot-plugins
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot-plugins_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_setroubleshoot-plugins

class remove_setroubleshoot-plugins {
  package { 'setroubleshoot-plugins':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_setroubleshoot-plugins_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=setroubleshoot-plugins
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_setroubleshoot-plugins_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_setroubleshoot-plugins_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_setroubleshoot-server_removed" severity="low">
            <xccdf-1.2:title>Uninstall setroubleshoot-server Package</xccdf-1.2:title>
            <xccdf-1.2:description>The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code>setroubleshoot-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase setroubleshoot-server</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R49</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The SETroubleshoot service is an unnecessary daemon to have
running on a server.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# CAUTION: This remediation script will remove setroubleshoot-server
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot-server" ; then
yum remove -y "setroubleshoot-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot-server_removed

- name: Ensure setroubleshoot-server is removed
  package:
    name: setroubleshoot-server
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot-server_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_setroubleshoot-server

class remove_setroubleshoot-server {
  package { 'setroubleshoot-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_setroubleshoot-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=setroubleshoot-server
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_setroubleshoot-server_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_setroubleshoot-server_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" severity="low">
            <xccdf-1.2:title>Uninstall setroubleshoot Package</xccdf-1.2:title>
            <xccdf-1.2:description>The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code>setroubleshoot</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase setroubleshoot</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R49</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The SETroubleshoot service is an unnecessary daemon to
have running on a server, especially if
X Windows is removed or disabled.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# CAUTION: This remediation script will remove setroubleshoot
#	   from the system, and may remove any packages
#	   that depend on setroubleshoot. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "setroubleshoot" ; then
yum remove -y "setroubleshoot"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot_removed

- name: Ensure setroubleshoot is removed
  package:
    name: setroubleshoot
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_setroubleshoot

class remove_setroubleshoot {
  package { 'setroubleshoot':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_setroubleshoot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=setroubleshoot
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_setroubleshoot_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_groupowner_etc_selinux" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns /etc/selinux Directory</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/selinux</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/selinux</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The ownership of the /etc/selinux directory by the root group is important
because this directory hosts SELinux configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the SELinux configuration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_groupowner_etc_selinux" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/selinux/ -maxdepth 1 -type d -exec chgrp -L root {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_groupowner_etc_selinux" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_groupowner_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/selinux/
  file:
    path: /etc/selinux/
    state: directory
    group: root
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_groupowner_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_groupowner_etc_selinux:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_groupowner_etc_selinux_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_owner_etc_selinux" severity="medium">
            <xccdf-1.2:title>Verify User Who Owns /etc/selinux Directory</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the owner of <html:code>/etc/selinux</html:code>, run the command: <html:pre>$ sudo chown root /etc/selinux </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The ownership of the /etc/selinux directory by the root user is important
because this directory hosts SELinux configuration. Protection of this
directory is critical for system security. Assigning the ownership to root
ensures exclusive control of the SELinux configuration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_owner_etc_selinux" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/selinux/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_owner_etc_selinux" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_owner_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/selinux/
  file:
    path: /etc/selinux/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_owner_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_owner_etc_selinux:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_owner_etc_selinux_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_etc_selinux" severity="medium">
            <xccdf-1.2:title>Verify Permissions On /etc/selinux Directory</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/selinux</html:code>, run the command: <html:pre>$ sudo chmod 0755 /etc/selinux</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting correct permissions on the /etc/selinux directory is important
because this directory hosts SELinux configuration. Protection of this
directory is critical for system security. Restricting the permissions
ensures exclusive control of the SELinux configuration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_etc_selinux" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/selinux/ -maxdepth 1 -perm /u+s,g+ws,o+wt -type d -exec chmod u-s,g-ws,o-wt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_permissions_etc_selinux" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - directory_permissions_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/selinux/ file(s)
  command: 'find -H /etc/selinux/ -maxdepth 1 -perm /u+s,g+ws,o+wt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_permissions_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/selinux/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-ws,o-wt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - directory_permissions_etc_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_etc_selinux:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_etc_selinux_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_sestatus_conf" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns /etc/sestatus.conf File</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/sestatus.conf</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/sestatus.conf</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The ownership of the /etc/sestatus.conf file by the root group is important
because this file hosts SELinux configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the SELinux configuration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_sestatus_conf" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp root /etc/sestatus.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_sestatus_conf" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupowner_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/sestatus.conf
  stat:
    path: /etc/sestatus.conf
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupowner_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner root on /etc/sestatus.conf
  file:
    path: /etc/sestatus.conf
    group: root
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_sestatus_conf:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_sestatus_conf_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_sestatus_conf" severity="medium">
            <xccdf-1.2:title>Verify User Who Owns /etc/sestatus.conf File</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the owner of <html:code>/etc/sestatus.conf</html:code>, run the command: <html:pre>$ sudo chown root /etc/sestatus.conf </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The ownership of the /etc/sestatus.conf file by the root user is important
because this file hosts SELinux configuration. Protection of this
file is critical for system security. Assigning the ownership to root
ensures exclusive control of the SELinux configuration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_sestatus_conf" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /etc/sestatus.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_sestatus_conf" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_owner_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/sestatus.conf
  stat:
    path: /etc/sestatus.conf
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_owner_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/sestatus.conf
  file:
    path: /etc/sestatus.conf
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_sestatus_conf:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_sestatus_conf_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_sestatus_conf" severity="medium">
            <xccdf-1.2:title>Verify Permissions On /etc/sestatus.conf File</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/sestatus.conf</html:code>, run the command: <html:pre>$ sudo chmod 0644 /etc/sestatus.conf</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting correct permissions on the /etc/sestatus.conf file is important
because this file hosts SELinux configuration. Protection of this
file is critical for system security. Restricting the permissions
ensures exclusive control of the SELinux configuration.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_sestatus_conf" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xws,o-xwt /etc/sestatus.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_sestatus_conf" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/sestatus.conf
  stat:
    path: /etc/sestatus.conf
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_permissions_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/sestatus.conf
  file:
    path: /etc/sestatus.conf
    mode: u-xs,g-xws,o-xwt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_sestatus_conf
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_sestatus_conf:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_sestatus_conf_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" severity="medium">
            <xccdf-1.2:title>Ensure SELinux Not Disabled in /etc/default/grub</xccdf-1.2:title>
            <xccdf-1.2:description>SELinux can be disabled at boot time by an argument in
<html:code>/etc/default/grub</html:code>.
Remove any instances of <html:code>selinux=0</html:code> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000022</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#grub2"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_enable_selinux"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q grub2-common; }; then

sed -i --follow-symlinks "s/selinux=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*
sed -i --follow-symlinks "s/enforcing=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_enable_selinux" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Find /etc/grub.d/ files
  ansible.builtin.find:
    paths:
    - /etc/grub.d/
    follow: true
  register: result_grub_d
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Ensure SELinux Not Disabled
    in /etc/grub.d/ files
  ansible.builtin.replace:
    dest: '{{ item.path }}'
    regexp: (selinux|enforcing)=0
  with_items:
  - '{{ result_grub_d.files }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Check if /etc/grub2.cfg
    exists
  ansible.builtin.stat:
    path: /etc/grub2.cfg
  register: result_grub2_cfg_present
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Check if /etc/default/grub
    exists
  ansible.builtin.stat:
    path: /etc/default/grub
  register: result_default_grub_present
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Ensure SELinux Not Disabled
    in /etc/grub2.cfg
  ansible.builtin.replace:
    dest: /etc/grub2.cfg
    regexp: (selinux|enforcing)=0
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  - result_grub2_cfg_present.stat.exists
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Ensure SELinux Not Disabled
    in /etc/default/grub
  ansible.builtin.replace:
    dest: /etc/default/grub
    regexp: (selinux|enforcing)=0
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  - result_default_grub_present.stat.exists
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_enable_selinux:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" severity="medium">
            <xccdf-1.2:title>Ensure No Device Files are Unlabeled by SELinux</xccdf-1.2:title>
            <xccdf-1.2:description>Device files, which are used for communication with important system
resources, should be labeled with proper SELinux types. If any device files
carry the SELinux type <html:code>device_t</html:code> or <html:code>unlabeled_t</html:code>, report the
bug so that policy can be corrected. Supply information about what the
device is and what programs use it.
<html:br/>
       <html:br/>
To check for incorrectly labeled device files, run following commands:
<html:pre>$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"</html:pre>
       <html:pre>$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"</html:pre>
It should produce no output in a well-configured system.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available. The remediation
can be achieved by amending SELinux policy.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002500</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271769r1092019_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If a device file carries the SELinux type <html:code>device_t</html:code> or
<html:code>unlabeled_t</html:code>, then SELinux cannot properly restrict access to the
device file.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-selinux_all_devicefiles_labeled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" severity="medium">
            <xccdf-1.2:title>Ensure No Daemons are Unconfined by SELinux</xccdf-1.2:title>
            <xccdf-1.2:description>Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the <html:code>init</html:code> process, they inherit the <html:code>unconfined_service_t</html:code> context.
<html:br/>
       <html:br/>
To check for unconfined daemons, run the following command:
<html:pre>$ sudo ps -eZ | grep "unconfined_service_t"</html:pre>
It should produce no output in a well-configured system.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available. Remediation
can be achieved by amending SELinux policy or stopping the unconfined
daemons as outlined above.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Daemons which run with the <html:code>unconfined_service_t</html:code> context may cause AVC denials,
or allow privileges that the daemon does not require.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-selinux_confinement_of_daemons:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_not_disabled" severity="high">
            <xccdf-1.2:title>Ensure SELinux is Not Disabled</xccdf-1.2:title>
            <xccdf-1.2:description>The SELinux state should be set to <html:code>enforcing</html:code> or <html:code>permissive</html:code> at system boot
time. In the file <html:code>/etc/selinux/config</html:code>, add or correct the following line to configure
the system to boot into enforcing or permissive mode:
<html:pre>SELINUX=enforcing</html:pre>
OR
<html:pre>SELINUX=permissive</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">In case the SELinux is "disabled", the automated remediation will adopt a more
conservative approach and set it to "permissive" in order to avoid any system disruption
and give the administrator the opportunity to assess the impact and necessary efforts
before setting it to "enforcing", which is strongly recommended.</xccdf-1.2:warning>
            <xccdf-1.2:rationale>Running SELinux in disabled mode is strongly discouraged. It prevents enforcing the SELinux
controls without a system reboot. It also avoids labeling any persistent objects such as
files, making it difficult to enable SELinux in the future.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="selinux_not_disabled" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=permissive" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot
fixfiles -f relabel

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="selinux_not_disabled" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled

- name: Ensure SELinux is Not Disabled
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/selinux/config
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      line: SELINUX=permissive
      state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-selinux_not_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-selinux_not_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_policytype" severity="medium">
            <xccdf-1.2:title>Configure SELinux Policy</xccdf-1.2:title>
            <xccdf-1.2:description>The SELinux <html:code>targeted</html:code> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in <html:code>/etc/selinux/config</html:code>:
<html:pre>SELINUXTYPE=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>
       </html:pre>
Other policies, such as <html:code>mls</html:code>, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000233-CTR-000585</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R46</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R64</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">APP.4.4.A4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A21</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000065</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271453r1091071_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting the SELinux policy to <html:code>targeted</html:code> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
<html:br/>
       <html:br/>
Note: During the development or debugging of SELinux modules, it is common to
temporarily place non-production systems in <html:code>permissive</html:code> mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/></html:code>.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="selinux_policytype" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_selinux_policy_name='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>'


if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUXTYPE=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUXTYPE=$var_selinux_policy_name" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="selinux_policytype" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000065
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - selinux_policytype
- name: XCCDF Value var_selinux_policy_name # promote to variable
  set_fact:
    var_selinux_policy_name: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>
  tags:
    - always

- name: Configure SELinux Policy
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUXTYPE=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUXTYPE=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/selinux/config
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUXTYPE=
      line: SELINUXTYPE={{ var_selinux_policy_name }}
      state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000065
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - selinux_policytype
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_selinux_policy_name:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_policy_name"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-selinux_policytype:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-selinux_policytype_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_selinux_state" severity="high">
            <xccdf-1.2:title>Ensure SELinux State is Enforcing</xccdf-1.2:title>
            <xccdf-1.2:description>The SELinux state should be set to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/></html:code> at
system boot time.  In the file <html:code>/etc/selinux/config</html:code>, add or correct the
following line to configure the system to boot into enforcing mode:
<html:pre>SELINUX=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>
       </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002696</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R37</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R79</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">APP.4.4.A4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A21</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.6.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000060</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271452r1091068_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting the SELinux state to enforcing ensures SELinux is able to confine
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="selinux_state" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_selinux_state='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>'


if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=$var_selinux_state" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot
fixfiles -f relabel

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="selinux_state" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000060
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state
- name: XCCDF Value var_selinux_state # promote to variable
  set_fact:
    var_selinux_state: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>
  tags:
    - always

- name: Ensure SELinux State is Enforcing
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/selinux/config
    lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      line: SELINUX={{ var_selinux_state }}
      state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000060
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_selinux_state:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_state"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-selinux_state:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-selinux_state_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_selinux-booleans">
            <xccdf-1.2:title>SELinux - Booleans</xccdf-1.2:title>
            <xccdf-1.2:description>Enable or Disable runtime customization of SELinux system policies
without having to reload or recompile the SELinux policy.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#selinux"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditadm_exec_content" type="boolean">
              <xccdf-1.2:title>auditadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap" type="boolean">
              <xccdf-1.2:title>authlogin_nsswitch_use_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_radius" type="boolean">
              <xccdf-1.2:title>authlogin_radius SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_deny_execmem" type="boolean">
              <xccdf-1.2:title>deny_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kerberos_enabled" type="boolean">
              <xccdf-1.2:title>kerberos_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" type="boolean">
              <xccdf-1.2:title>polyinstantiation_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" type="boolean">
              <xccdf-1.2:title>secure_mode_insmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap" type="boolean">
              <xccdf-1.2:title>selinuxuser_execheap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod" type="boolean">
              <xccdf-1.2:title>selinuxuser_execmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack" type="boolean">
              <xccdf-1.2:title>selinuxuser_execstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login" type="boolean">
              <xccdf-1.2:title>ssh_sysadm_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content" severity="medium">
              <xccdf-1.2:title>Enable the auditadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>auditadm_exec_content</html:code> is enabled.
If this setting is disabled, it should be enabled.

To enable the <html:code>auditadm_exec_content</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P auditadm_exec_content on</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">80424-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_auditadm_exec_content" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_auditadm_exec_content='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditadm_exec_content" use="legacy"/>'

    setsebool -P auditadm_exec_content $var_auditadm_exec_content

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_auditadm_exec_content" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-80424-5
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_auditadm_exec_content

- name: Enable the auditadm_exec_content SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-80424-5
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_auditadm_exec_content
- name: XCCDF Value var_auditadm_exec_content # promote to variable
  set_fact:
    var_auditadm_exec_content: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditadm_exec_content" use="legacy"/>
  tags:
    - always

- name: Enable the auditadm_exec_content SELinux Boolean - Set SELinux Boolean auditadm_exec_content
    Accordingly
  seboolean:
    name: auditadm_exec_content
    state: '{{ var_auditadm_exec_content }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - NIST-800-171-80424-5
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_auditadm_exec_content
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditadm_exec_content:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditadm_exec_content"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_auditadm_exec_content:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_auditadm_exec_content_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_authlogin_nsswitch_use_ldap" severity="medium">
              <xccdf-1.2:title>Disable the authlogin_nsswitch_use_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>authlogin_nsswitch_use_ldap</html:code> is disabled.
If this setting is enabled, it should be disabled.

To disable the <html:code>authlogin_nsswitch_use_ldap</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P authlogin_nsswitch_use_ldap off</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_authlogin_nsswitch_use_ldap" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_authlogin_nsswitch_use_ldap='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap" use="legacy"/>'

    setsebool -P authlogin_nsswitch_use_ldap $var_authlogin_nsswitch_use_ldap

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_authlogin_nsswitch_use_ldap" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_authlogin_nsswitch_use_ldap

- name: Disable the authlogin_nsswitch_use_ldap SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_authlogin_nsswitch_use_ldap
- name: XCCDF Value var_authlogin_nsswitch_use_ldap # promote to variable
  set_fact:
    var_authlogin_nsswitch_use_ldap: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap" use="legacy"/>
  tags:
    - always

- name: Disable the authlogin_nsswitch_use_ldap SELinux Boolean - Set SELinux Boolean
    authlogin_nsswitch_use_ldap Accordingly
  seboolean:
    name: authlogin_nsswitch_use_ldap
    state: '{{ var_authlogin_nsswitch_use_ldap }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_authlogin_nsswitch_use_ldap
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_authlogin_nsswitch_use_ldap:var:1" value-id="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_authlogin_nsswitch_use_ldap:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_authlogin_radius" severity="medium">
              <xccdf-1.2:title>Disable the authlogin_radius SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>authlogin_radius</html:code> is disabled.
If this setting is enabled, it should be disabled.

To disable the <html:code>authlogin_radius</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P authlogin_radius off</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_authlogin_radius" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_authlogin_radius='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authlogin_radius" use="legacy"/>'

    setsebool -P authlogin_radius $var_authlogin_radius

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_authlogin_radius" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_authlogin_radius

- name: Disable the authlogin_radius SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_authlogin_radius
- name: XCCDF Value var_authlogin_radius # promote to variable
  set_fact:
    var_authlogin_radius: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_authlogin_radius" use="legacy"/>
  tags:
    - always

- name: Disable the authlogin_radius SELinux Boolean - Set SELinux Boolean authlogin_radius
    Accordingly
  seboolean:
    name: authlogin_radius
    state: '{{ var_authlogin_radius }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_authlogin_radius
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_authlogin_radius:var:1" value-id="xccdf_org.ssgproject.content_value_var_authlogin_radius"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_authlogin_radius:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_authlogin_radius_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_deny_execmem" severity="medium">
              <xccdf-1.2:title>Configure the deny_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>deny_execmem</html:code> is disabled.
This setting should be configured to <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_deny_execmem" use="legacy"/>.
<html:br/>
To set the <html:code>deny_execmem</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P deny_execmem <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_deny_execmem" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, as enabling this SELinux boolean can cause
applications to malfunction, for example Graphical login managers and Firefox.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="functionality">Proper function and stability should be assessed before applying enabling the SELinux
boolean in production systems.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R48</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Allowing user domain applications to map a memory region as both writable and
executable makes them more susceptible to data execution attacks.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_deny_execmem:var:1" value-id="xccdf_org.ssgproject.content_value_var_deny_execmem"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_deny_execmem:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_deny_execmem_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_kerberos_enabled" severity="medium">
              <xccdf-1.2:title>Enable the kerberos_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>kerberos_enabled</html:code> is enabled.
If this setting is disabled, it should be enabled to allow confined
applications to run with Kerberos.

To enable the <html:code>kerberos_enabled</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P kerberos_enabled on</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_kerberos_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_kerberos_enabled='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kerberos_enabled" use="legacy"/>'

    setsebool -P kerberos_enabled $var_kerberos_enabled

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_kerberos_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_kerberos_enabled

- name: Enable the kerberos_enabled SELinux Boolean - Ensure python3-libsemanage Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_kerberos_enabled
- name: XCCDF Value var_kerberos_enabled # promote to variable
  set_fact:
    var_kerberos_enabled: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_kerberos_enabled" use="legacy"/>
  tags:
    - always

- name: Enable the kerberos_enabled SELinux Boolean - Set SELinux Boolean kerberos_enabled
    Accordingly
  seboolean:
    name: kerberos_enabled
    state: '{{ var_kerberos_enabled }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_kerberos_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_kerberos_enabled:var:1" value-id="xccdf_org.ssgproject.content_value_var_kerberos_enabled"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_kerberos_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_kerberos_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_polyinstantiation_enabled" severity="medium">
              <xccdf-1.2:title>Configure the polyinstantiation_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>polyinstantiation_enabled</html:code> is disabled.
This setting should be configured to <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" use="legacy"/>.
<html:br/>
To set the <html:code>polyinstantiation_enabled</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P polyinstantiation_enabled <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R55</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_polyinstantiation_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_polyinstantiation_enabled='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" use="legacy"/>'

    setsebool -P polyinstantiation_enabled $var_polyinstantiation_enabled

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_polyinstantiation_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_polyinstantiation_enabled

- name: Configure the polyinstantiation_enabled SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_polyinstantiation_enabled
- name: XCCDF Value var_polyinstantiation_enabled # promote to variable
  set_fact:
    var_polyinstantiation_enabled: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" use="legacy"/>
  tags:
    - always

- name: Configure the polyinstantiation_enabled SELinux Boolean - Set SELinux Boolean
    polyinstantiation_enabled Accordingly
  seboolean:
    name: polyinstantiation_enabled
    state: '{{ var_polyinstantiation_enabled }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_polyinstantiation_enabled
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_polyinstantiation_enabled:var:1" value-id="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_polyinstantiation_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_polyinstantiation_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_secure_mode_insmod" severity="medium">
              <xccdf-1.2:title>Configure the secure_mode_insmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>secure_mode_insmod</html:code> is disabled.
This setting should be configured to <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" use="legacy"/>.
<html:br/>
To set the <html:code>secure_mode_insmod</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P secure_mode_insmod <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R48</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_secure_mode_insmod" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_secure_mode_insmod='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" use="legacy"/>'

setsebool -P secure_mode_insmod $var_secure_mode_insmod

# Preload vfat in initramfs, otherwise the system fails to reboot
echo "vfat" &gt;&gt; /etc/modules-load.d/vfat.conf
dracut -f --regenerate-all

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_secure_mode_insmod" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_secure_mode_insmod
- name: XCCDF Value var_secure_mode_insmod # promote to variable
  set_fact:
    var_secure_mode_insmod: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" use="legacy"/>
  tags:
    - always

- name: Configure the secure_mode_insmod SELinux Boolean - Ensure libsemanage-python
    installed
  ansible.builtin.package:
    name: libsemanage-python
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_secure_mode_insmod

- name: Configure the secure_mode_insmod SELinux Boolean - Set SELinux boolean secure_mode_insmod
    accordingly
  ansible.posix.seboolean:
    name: secure_mode_insmod
    state: '{{ var_secure_mode_insmod }}'
    persistent: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_secure_mode_insmod

- name: Configure the secure_mode_insmod SELinux Boolean - Add vfat to static kernel
    module list
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modules-load.d/vfat.conf
    regexp: ^\s*\bvfat\b
    line: vfat
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_secure_mode_insmod

- name: Configure the secure_mode_insmod SELinux Boolean - Regenerate initramfs
  ansible.builtin.command:
    cmd: dracut -f --regenerate-all
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_secure_mode_insmod
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_secure_mode_insmod:var:1" value-id="xccdf_org.ssgproject.content_value_var_secure_mode_insmod"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_secure_mode_insmod:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_secure_mode_insmod_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execheap" severity="medium">
              <xccdf-1.2:title>Disable the selinuxuser_execheap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>selinuxuser_execheap</html:code> is disabled.
When enabled this boolean is enabled it allows selinuxusers to execute code from the heap.
If this setting is enabled, it should be disabled.

To disable the <html:code>selinuxuser_execheap</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P selinuxuser_execheap off</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R48</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling code execution from the heap blocks buffer overflow attacks.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_selinuxuser_execheap" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_selinuxuser_execheap='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap" use="legacy"/>'

    setsebool -P selinuxuser_execheap $var_selinuxuser_execheap

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_selinuxuser_execheap" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execheap

- name: Disable the selinuxuser_execheap SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execheap
- name: XCCDF Value var_selinuxuser_execheap # promote to variable
  set_fact:
    var_selinuxuser_execheap: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap" use="legacy"/>
  tags:
    - always

- name: Disable the selinuxuser_execheap SELinux Boolean - Set SELinux Boolean selinuxuser_execheap
    Accordingly
  seboolean:
    name: selinuxuser_execheap
    state: '{{ var_selinuxuser_execheap }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execheap
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_selinuxuser_execheap:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_selinuxuser_execheap:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_selinuxuser_execheap_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execmod" severity="medium">
              <xccdf-1.2:title>Enable the selinuxuser_execmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>selinuxuser_execmod</html:code> is enabled.
If this setting is disabled, it should be enabled.

To enable the <html:code>selinuxuser_execmod</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P selinuxuser_execmod on</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:rationale/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_selinuxuser_execmod" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_selinuxuser_execmod='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod" use="legacy"/>'

    setsebool -P selinuxuser_execmod $var_selinuxuser_execmod

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_selinuxuser_execmod" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execmod

- name: Enable the selinuxuser_execmod SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execmod
- name: XCCDF Value var_selinuxuser_execmod # promote to variable
  set_fact:
    var_selinuxuser_execmod: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod" use="legacy"/>
  tags:
    - always

- name: Enable the selinuxuser_execmod SELinux Boolean - Set SELinux Boolean selinuxuser_execmod
    Accordingly
  seboolean:
    name: selinuxuser_execmod
    state: '{{ var_selinuxuser_execmod }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execmod
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_selinuxuser_execmod:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_selinuxuser_execmod:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_selinuxuser_execmod_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execstack" severity="medium">
              <xccdf-1.2:title>Disable the selinuxuser_execstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>selinuxuser_execstack</html:code> is enabled.
This setting should be disabled as unconfined executables should not be able
to make their stack executable.

To disable the <html:code>selinuxuser_execstack</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P selinuxuser_execstack off</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R48</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disabling code execution from the stack blocks buffer overflow attacks.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_selinuxuser_execstack" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_selinuxuser_execstack='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack" use="legacy"/>'

    setsebool -P selinuxuser_execstack $var_selinuxuser_execstack

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_selinuxuser_execstack" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execstack

- name: Disable the selinuxuser_execstack SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execstack
- name: XCCDF Value var_selinuxuser_execstack # promote to variable
  set_fact:
    var_selinuxuser_execstack: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack" use="legacy"/>
  tags:
    - always

- name: Disable the selinuxuser_execstack SELinux Boolean - Set SELinux Boolean selinuxuser_execstack
    Accordingly
  seboolean:
    name: selinuxuser_execstack
    state: '{{ var_selinuxuser_execstack }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_selinuxuser_execstack
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_selinuxuser_execstack:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_selinuxuser_execstack:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_selinuxuser_execstack_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sebool_ssh_sysadm_login" severity="medium">
              <xccdf-1.2:title>Disable the ssh_sysadm_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SELinux boolean <html:code>ssh_sysadm_login</html:code> is disabled.
If this setting is enabled, it should be disabled.

To disable the <html:code>ssh_sysadm_login</html:code> SELinux boolean, run the following command:
<html:pre>$ sudo setsebool -P ssh_sysadm_login off</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002165</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R48</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Preventing non-privileged users from executing privileged functions mitigates
the risk that unauthorized individuals or processes may gain unnecessary access
to information or privileges.

Privileged functions include, for example, establishing accounts, performing
system integrity checks, or administering cryptographic key management
activities. Non-privileged users are individuals who do not possess appropriate
authorizations. Circumventing intrusion detection and prevention mechanisms or
malicious code protection mechanisms are examples of privileged functions that
require protection from non-privileged users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sebool_ssh_sysadm_login" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi


if selinuxenabled || [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then

    var_ssh_sysadm_login='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login" use="legacy"/>'

    setsebool -P ssh_sysadm_login $var_ssh_sysadm_login

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sebool_ssh_sysadm_login" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_ssh_sysadm_login

- name: Disable the ssh_sysadm_login SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_ssh_sysadm_login
- name: XCCDF Value var_ssh_sysadm_login # promote to variable
  set_fact:
    var_ssh_sysadm_login: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login" use="legacy"/>
  tags:
    - always

- name: Disable the ssh_sysadm_login SELinux Boolean - Set SELinux Boolean ssh_sysadm_login
    Accordingly
  seboolean:
    name: ssh_sysadm_login
    state: '{{ var_ssh_sysadm_login }}'
    persistent: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_ssh_sysadm_login
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_ssh_sysadm_login:var:1" value-id="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sebool_ssh_sysadm_login:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sebool_ssh_sysadm_login_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_services">
        <xccdf-1.2:title>Services</xccdf-1.2:title>
        <xccdf-1.2:description>The best protection against vulnerable software is running less software. This section describes how to review
the software which Oracle Linux 9 installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Oracle Linux 9 system and provides guidance about which
ones can be safely disabled.
<html:br/>
     <html:br/>
Oracle Linux 9 provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Oracle Linux 9 systems, it is highly recommended to select the minimal packages and then build up
the system from there.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_avahi">
          <xccdf-1.2:title>Avahi Server</xccdf-1.2:title>
          <xccdf-1.2:description>The Avahi daemon implements the DNS Service Discovery
and Multicast DNS protocols, which provide service and host
discovery on a network. It allows a system to automatically
identify resources on the network, such as printers or web servers.
This capability is also known as mDNSresponder and is a major part
of Zeroconf networking.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_avahi_configuration">
            <xccdf-1.2:title>Configure Avahi if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If your system requires the Avahi daemon, its configuration can be restricted
to improve security. The Avahi daemon configuration file is
<html:code>/etc/avahi/avahi-daemon.conf</html:code>. The following security recommendations
should be applied to this file:
See the <html:code>avahi-daemon.conf(5)</html:code> man page, or documentation at

    <html:a href="http://www.avahi.org">http://www.avahi.org</html:a>, for more detailed information
about the configuration options.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_avahi_disable_publishing" severity="low">
              <xccdf-1.2:title>Disable Avahi Publishing</xccdf-1.2:title>
              <xccdf-1.2:description>To prevent Avahi from publishing its records, edit <html:code>/etc/avahi/avahi-daemon.conf</html:code>
and ensure the following line appears in the <html:code>[publish]</html:code> section:
<html:pre>disable-publishing=yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This helps ensure that no record will be published by Avahi.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disable_avahi_group">
            <xccdf-1.2:title>Disable Avahi Server if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>Because the Avahi daemon service keeps an open network
port, it is subject to network attacks.
Disabling it can reduce the system's vulnerability to such attacks.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled" severity="medium">
              <xccdf-1.2:title>Disable Avahi Server Software</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>avahi-daemon</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now avahi-daemon.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Because the Avahi daemon service keeps an open network
port, it is subject to network attacks. Its functionality
is convenient but is only appropriate if the local network
can be trusted.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_avahi_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_avahi-daemon_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q avahi &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'avahi-daemon.service'
fi
"$SYSTEMCTL_EXEC" disable 'avahi-daemon.service'
"$SYSTEMCTL_EXEC" mask 'avahi-daemon.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files avahi-daemon.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'avahi-daemon.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'avahi-daemon.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'avahi-daemon.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_avahi-daemon_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_avahi-daemon_disabled

- name: Disable Avahi Server Software - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "avahi" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_avahi-daemon_disabled

- name: Disable Avahi Server Software - Ensure avahi-daemon.service is Masked
  ansible.builtin.systemd:
    name: avahi-daemon.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "avahi" in ansible_facts.packages and ("kernel" in ansible_facts.packages or
    "kernel-uek" in ansible_facts.packages) )
  - service_exists.stdout_lines is search("avahi-daemon.service", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_avahi-daemon_disabled

- name: Unit Socket Exists - avahi-daemon.socket
  ansible.builtin.command: systemctl -q list-unit-files avahi-daemon.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "avahi" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_avahi-daemon_disabled

- name: Disable Avahi Server Software - Disable Socket avahi-daemon
  ansible.builtin.systemd:
    name: avahi-daemon.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "avahi" in ansible_facts.packages and ("kernel" in ansible_facts.packages or
    "kernel-uek" in ansible_facts.packages) )
  - socket_file_exists.stdout_lines is search("avahi-daemon.socket", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_avahi-daemon_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_avahi-daemon_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_avahi-daemon

class disable_avahi-daemon {
  service {'avahi-daemon':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_avahi-daemon_disabled">
[customizations.services]
masked = ["avahi-daemon"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_avahi-daemon_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_avahi-daemon_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_base">
          <xccdf-1.2:title>Base Services</xccdf-1.2:title>
          <xccdf-1.2:description>This section addresses the base services that are installed on a
Oracle Linux 9 default installation which are not covered in other
sections. Some of these services listen on the network and
should be treated with particular discretion. Other services are local
system utilities that may or may not be extraneous. In general, system services
should be disabled if not required.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_kdump_disabled" severity="medium">
            <xccdf-1.2:title>Disable KDump Kernel Crash Analyzer (kdump)</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>kdump</html:code> service provides a kernel crash dump analyzer. It uses the <html:code>kexec</html:code>
system call to boot a secondary kernel ("capture" kernel) following a system
crash, which can load information from the crashed kernel for analysis.

The <html:code>kdump</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now kdump.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000269-GPOS-00103</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002385</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271733r1092598_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Kernel core dumps may contain the full contents of system memory at the
time of the crash. Kernel core dumps consume a considerable amount of disk
space and may result in denial of service by exhausting the available space
on the target file system partition. Unless the system is used for kernel
development or testing, there is little need to run the kdump service.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_kdump_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'kdump.service'
fi
"$SYSTEMCTL_EXEC" disable 'kdump.service'
"$SYSTEMCTL_EXEC" mask 'kdump.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files kdump.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'kdump.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'kdump.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'kdump.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_kdump_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002385
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_kdump_disabled

- name: Disable KDump Kernel Crash Analyzer (kdump) - Collect systemd Services Present
    in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002385
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_kdump_disabled

- name: Disable KDump Kernel Crash Analyzer (kdump) - Ensure kdump.service is Masked
  ansible.builtin.systemd:
    name: kdump.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("kdump.service", multiline=True)
  tags:
  - DISA-STIG-OL09-00-002385
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_kdump_disabled

- name: Unit Socket Exists - kdump.socket
  ansible.builtin.command: systemctl -q list-unit-files kdump.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002385
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_kdump_disabled

- name: Disable KDump Kernel Crash Analyzer (kdump) - Disable Socket kdump
  ansible.builtin.systemd:
    name: kdump.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("kdump.socket", multiline=True)
  tags:
  - DISA-STIG-OL09-00-002385
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_kdump_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_kdump_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_kdump

class disable_kdump {
  service {'kdump':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="service_kdump_disabled">
kdump --disable
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_kdump_disabled">
[customizations.services]
masked = ["kdump"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_kdump_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_kdump_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_oddjobd_disabled" severity="medium">
            <xccdf-1.2:title>Disable Odd Job Daemon (oddjobd)</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>oddjobd</html:code> service exists to provide an interface and
access control mechanism through which
specified privileged tasks can run tasks for unprivileged client
applications. Communication with <html:code>oddjobd</html:code> through the system message bus.

The <html:code>oddjobd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now oddjobd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>oddjobd</html:code> service may provide necessary functionality in
some environments, and can be disabled if it is not needed. Execution of
tasks by privileged programs, on behalf of unprivileged ones, has traditionally
been a source of privilege escalation security issues.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_oddjobd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'oddjobd.service'
fi
"$SYSTEMCTL_EXEC" disable 'oddjobd.service'
"$SYSTEMCTL_EXEC" mask 'oddjobd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files oddjobd.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'oddjobd.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'oddjobd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'oddjobd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_oddjobd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_oddjobd_disabled

- name: Disable Odd Job Daemon (oddjobd) - Collect systemd Services Present in the
    System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_oddjobd_disabled

- name: Disable Odd Job Daemon (oddjobd) - Ensure oddjobd.service is Masked
  ansible.builtin.systemd:
    name: oddjobd.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("oddjobd.service", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_oddjobd_disabled

- name: Unit Socket Exists - oddjobd.socket
  ansible.builtin.command: systemctl -q list-unit-files oddjobd.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_oddjobd_disabled

- name: Disable Odd Job Daemon (oddjobd) - Disable Socket oddjobd
  ansible.builtin.systemd:
    name: oddjobd.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("oddjobd.socket", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_oddjobd_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_oddjobd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_oddjobd

class disable_oddjobd {
  service {'oddjobd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_oddjobd_disabled">
[customizations.services]
masked = ["oddjobd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_oddjobd_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_oddjobd_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rdisc_disabled" severity="medium">
            <xccdf-1.2:title>Disable Network Router Discovery Daemon (rdisc)</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>rdisc</html:code> service implements the client side of the ICMP
Internet Router Discovery Protocol (IRDP), which allows discovery of routers on
the local subnet. If a router is discovered then the local routing table is
updated with a corresponding default route. By default this daemon is disabled.

The <html:code>rdisc</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rdisc.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>General-purpose systems typically have their network and routing
information configured statically by a system administrator. Workstations or
some special-purpose systems often use DHCP (instead of IRDP) to retrieve
dynamic network configuration information.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rdisc_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'rdisc.service'
fi
"$SYSTEMCTL_EXEC" disable 'rdisc.service'
"$SYSTEMCTL_EXEC" mask 'rdisc.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files rdisc.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'rdisc.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'rdisc.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rdisc.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rdisc_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rdisc_disabled

- name: Disable Network Router Discovery Daemon (rdisc) - Collect systemd Services
    Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rdisc_disabled

- name: Disable Network Router Discovery Daemon (rdisc) - Ensure rdisc.service is
    Masked
  ansible.builtin.systemd:
    name: rdisc.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("rdisc.service", multiline=True)
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rdisc_disabled

- name: Unit Socket Exists - rdisc.socket
  ansible.builtin.command: systemctl -q list-unit-files rdisc.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rdisc_disabled

- name: Disable Network Router Discovery Daemon (rdisc) - Disable Socket rdisc
  ansible.builtin.systemd:
    name: rdisc.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("rdisc.socket", multiline=True)
  tags:
  - NIST-800-53-AC-4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rdisc_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rdisc_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rdisc

class disable_rdisc {
  service {'rdisc':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rdisc_disabled">
[customizations.services]
masked = ["rdisc"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_rdisc_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_rdisc_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_cron_and_at">
          <xccdf-1.2:title>Cron and At Daemons</xccdf-1.2:title>
          <xccdf-1.2:description>The cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_cron_installed" severity="medium">
            <xccdf-1.2:title>Install the cron service</xccdf-1.2:title>
            <xccdf-1.2:description>The Cron service should be installed.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "cronie" ; then
    yum install -y "cronie"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_cron_installed

- name: Ensure cronie is installed
  package:
    name: cronie
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_cron_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_cronie

class install_cronie {
  package { 'cronie':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_cron_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=cronie
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_cron_installed">
[[packages]]
name = "cronie"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_cron_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_cron_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_crond_enabled" severity="medium">
            <xccdf-1.2:title>Enable cron Service</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>crond</html:code> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.

The <html:code>crond</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable crond.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_crond_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'crond.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'crond.service'
fi
"$SYSTEMCTL_EXEC" enable 'crond.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_crond_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_crond_enabled

- name: Enable cron Service - Enable service crond
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable cron Service - Enable Service crond
    ansible.builtin.systemd:
      name: crond
      enabled: true
      state: started
      masked: false
    when:
    - '"cronie" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_crond_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_crond_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_crond

class enable_crond {
  service {'crond':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_crond_enabled">
[customizations.services]
enabled = ["crond"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_crond_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_crond_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_atd_disabled" severity="medium">
            <xccdf-1.2:title>Disable At Service (atd)</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>at</html:code> and <html:code>batch</html:code> commands can be used to
schedule tasks that are meant to be executed only once. This allows delayed
execution in a manner similar to cron, except that it is not
recurring. The daemon <html:code>atd</html:code> keeps track of tasks scheduled via
<html:code>at</html:code> and <html:code>batch</html:code>, and executes them at the specified time.

The <html:code>atd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now atd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>atd</html:code> service could be used by an unsophisticated insider to carry
out activities outside of a normal login session, which could complicate
accountability. Furthermore, the need to schedule tasks with <html:code>at</html:code> or
<html:code>batch</html:code> is not common.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_atd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'atd.service'
fi
"$SYSTEMCTL_EXEC" disable 'atd.service'
"$SYSTEMCTL_EXEC" mask 'atd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files atd.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'atd.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'atd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'atd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_atd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_atd_disabled

- name: Disable At Service (atd) - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_atd_disabled

- name: Disable At Service (atd) - Ensure atd.service is Masked
  ansible.builtin.systemd:
    name: atd.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("atd.service", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_atd_disabled

- name: Unit Socket Exists - atd.socket
  ansible.builtin.command: systemctl -q list-unit-files atd.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_atd_disabled

- name: Disable At Service (atd) - Disable Socket atd
  ansible.builtin.systemd:
    name: atd.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("atd.socket", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_atd_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_atd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_atd

class disable_atd {
  service {'atd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_atd_disabled">
[customizations.services]
masked = ["atd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_atd_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_atd_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns cron.d</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/cron.d</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.d</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_d" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.d/ -maxdepth 1 -type d -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_d" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.d/
  file:
    path: /etc/cron.d/
    state: directory
    group: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_d:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_d_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns cron.daily</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/cron.daily</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.daily</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_daily" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.daily/ -maxdepth 1 -type d -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_daily" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.daily/
  file:
    path: /etc/cron.daily/
    state: directory
    group: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_daily:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_daily_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_deny" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns cron.deny</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/cron.deny</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.deny</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6 b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_deny" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp 0 /etc/cron.deny

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_deny" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-CM-6 b
  - configure_strategy
  - file_groupowner_cron_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.deny
  stat:
    path: /etc/cron.deny
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-CM-6 b
  - configure_strategy
  - file_groupowner_cron_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/cron.deny
  file:
    path: /etc/cron.deny
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-CM-6 b
  - configure_strategy
  - file_groupowner_cron_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_deny:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_deny_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns cron.hourly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/cron.hourly</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.hourly</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_hourly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.hourly/ -maxdepth 1 -type d -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_hourly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.hourly/
  file:
    path: /etc/cron.hourly/
    state: directory
    group: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_hourly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_hourly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns cron.monthly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/cron.monthly</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.monthly</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_monthly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.monthly/ -maxdepth 1 -type d -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_monthly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.monthly/
  file:
    path: /etc/cron.monthly/
    state: directory
    group: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_monthly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_monthly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns cron.weekly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/cron.weekly</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.weekly</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_weekly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.weekly/ -maxdepth 1 -type d -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_weekly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.weekly/
  file:
    path: /etc/cron.weekly/
    state: directory
    group: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_weekly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_weekly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns Crontab</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/crontab</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/crontab</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002581</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271828r1092196_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_crontab" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp 0 /etc/crontab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_crontab" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/crontab
  stat:
    path: /etc/crontab
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/crontab
  file:
    path: /etc/crontab
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002581
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_crontab:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_crontab_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_d" severity="medium">
            <xccdf-1.2:title>Verify Owner on cron.d</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/cron.d</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.d </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_d" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.d/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_d" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.d/
  file:
    path: /etc/cron.d/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_d:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_d_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" severity="medium">
            <xccdf-1.2:title>Verify Owner on cron.daily</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/cron.daily</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.daily </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_daily" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.daily/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_daily" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.daily/
  file:
    path: /etc/cron.daily/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_daily:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_daily_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_deny" severity="medium">
            <xccdf-1.2:title>Verify Owner on cron.deny</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/cron.deny</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.deny </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6 b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_deny" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /etc/cron.deny

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_deny" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-CM-6 b
  - configure_strategy
  - file_owner_cron_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.deny
  stat:
    path: /etc/cron.deny
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-CM-6 b
  - configure_strategy
  - file_owner_cron_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/cron.deny
  file:
    path: /etc/cron.deny
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-CM-6 b
  - configure_strategy
  - file_owner_cron_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_deny:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_deny_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" severity="medium">
            <xccdf-1.2:title>Verify Owner on cron.hourly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/cron.hourly</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.hourly </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_hourly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.hourly/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_hourly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.hourly/
  file:
    path: /etc/cron.hourly/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_hourly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_hourly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" severity="medium">
            <xccdf-1.2:title>Verify Owner on cron.monthly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/cron.monthly</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.monthly </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_monthly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.monthly/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_monthly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.monthly/
  file:
    path: /etc/cron.monthly/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_monthly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_monthly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" severity="medium">
            <xccdf-1.2:title>Verify Owner on cron.weekly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/cron.weekly</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.weekly </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_weekly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.weekly/ -maxdepth 1 -type d -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_weekly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.weekly/
  file:
    path: /etc/cron.weekly/
    state: directory
    owner: '0'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_weekly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_weekly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_crontab" severity="medium">
            <xccdf-1.2:title>Verify Owner on crontab</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/crontab</html:code>, run the command:
<html:pre>$ sudo chown root /etc/crontab </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271829r1092199_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_crontab" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /etc/crontab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_crontab" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/crontab
  stat:
    path: /etc/crontab
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/crontab
  file:
    path: /etc/crontab
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002582
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_crontab:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_crontab_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" severity="medium">
            <xccdf-1.2:title>Verify Permissions on cron.d</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/cron.d</html:code>, run the command:
<html:pre>$ sudo chmod 0700 /etc/cron.d</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002580</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271827r1092193_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_cron_d" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.d/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_cron_d" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.d/ file(s)
  command: 'find -H /etc/cron.d/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_cron_d:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_cron_d_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" severity="medium">
            <xccdf-1.2:title>Verify Permissions on cron.daily</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/cron.daily</html:code>, run the command:
<html:pre>$ sudo chmod 0700 /etc/cron.daily</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002580</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271827r1092193_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_cron_daily" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.daily/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_cron_daily" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.daily/ file(s)
  command: 'find -H /etc/cron.daily/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.daily/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_cron_daily:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_cron_daily_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" severity="medium">
            <xccdf-1.2:title>Verify Permissions on cron.hourly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/cron.hourly</html:code>, run the command:
<html:pre>$ sudo chmod 0700 /etc/cron.hourly</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002580</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271827r1092193_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_cron_hourly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.hourly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_cron_hourly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.hourly/ file(s)
  command: 'find -H /etc/cron.hourly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.hourly/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_cron_hourly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_cron_hourly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" severity="medium">
            <xccdf-1.2:title>Verify Permissions on cron.monthly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/cron.monthly</html:code>, run the command:
<html:pre>$ sudo chmod 0700 /etc/cron.monthly</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002580</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271827r1092193_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_cron_monthly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.monthly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_cron_monthly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.monthly/ file(s)
  command: 'find -H /etc/cron.monthly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.monthly/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_cron_monthly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_cron_monthly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" severity="medium">
            <xccdf-1.2:title>Verify Permissions on cron.weekly</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/cron.weekly</html:code>, run the command:
<html:pre>$ sudo chmod 0700 /etc/cron.weekly</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002580</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271827r1092193_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_cron_weekly" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -H /etc/cron.weekly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_cron_weekly" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.weekly/ file(s)
  command: 'find -H /etc/cron.weekly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.weekly/ file(s)
  file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002580
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_cron_weekly:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_cron_weekly_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_crontab" severity="medium">
            <xccdf-1.2:title>Verify Permissions on crontab</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/crontab</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /etc/crontab</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002583</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271830r1092202_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_crontab" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xwrs,o-xwrt /etc/crontab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_crontab" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002583
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/crontab
  stat:
    path: /etc/crontab
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002583
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/crontab
  file:
    path: /etc/crontab
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002583
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_crontab:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_crontab_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_restrict_at_cron_users">
            <xccdf-1.2:title>Restrict at and cron to Authorized Users if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>/etc/cron.allow</html:code> and <html:code>/etc/at.allow</html:code> files contain lists of
users who are allowed to use <html:code>cron</html:code> and at to delay execution of
processes. If these files exist and if the corresponding files
<html:code>/etc/cron.deny</html:code> and <html:code>/etc/at.deny</html:code> do not exist, then only users
listed in the relevant allow files can run the crontab and <html:code>at</html:code> commands
to submit jobs to be run at scheduled intervals. On many systems, only the
system administrator needs the ability to schedule jobs. Note that even if a
given user is not listed in <html:code>cron.allow</html:code>, cron jobs can still be run as
that user. The <html:code>cron.allow</html:code> file controls only administrative access
to the crontab command for scheduling and modifying cron jobs.
<html:br/>
       <html:br/>
To restrict <html:code>at</html:code> and <html:code>cron</html:code> to only authorized users:
<html:ul><html:li>Remove the <html:code>cron.deny</html:code> file:<html:pre>$ sudo rm /etc/cron.deny</html:pre>
        </html:li><html:li>Edit <html:code>/etc/cron.allow</html:code>, adding one line for each user allowed to use
the crontab command to create cron jobs.</html:li><html:li>Remove the <html:code>at.deny</html:code> file:<html:pre>$ sudo rm /etc/at.deny</html:pre>
        </html:li><html:li>Edit <html:code>/etc/at.allow</html:code>, adding one line for each user allowed to use
the at command to create at jobs.</html:li></html:ul>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" severity="medium">
              <xccdf-1.2:title>Ensure that /etc/at.deny does not exist</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/etc/at.deny</html:code> should not exist.
Use <html:code>/etc/at.allow</html:code> instead.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Access to <html:code>at</html:code> should be restricted.
It is easier to manage an allow list than a deny list.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_at_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [[ -f  /etc/at.deny ]]; then
        rm /etc/at.deny
    fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_at_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_at_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Remove /etc/at.deny
  file:
    path: /etc/at.deny
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_at_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_at_deny_not_exist:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_at_deny_not_exist_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" severity="medium">
              <xccdf-1.2:title>Ensure that /etc/cron.deny does not exist</xccdf-1.2:title>
              <xccdf-1.2:description>The file <html:code>/etc/cron.deny</html:code> should not exist.
Use <html:code>/etc/cron.allow</html:code> instead.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Access to <html:code>cron</html:code> should be restricted.
It is easier to manage an allow list than a deny list.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_cron_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [[ -f  /etc/cron.deny ]]; then
        rm /etc/cron.deny
    fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_cron_deny_not_exist" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_cron_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Remove /etc/cron.deny
  file:
    path: /etc/cron.deny
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_cron_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_cron_deny_not_exist:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_cron_deny_not_exist_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_at_allow" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/at.allow file</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>/etc/at.allow</html:code> exists, it must be group-owned by <html:code>root</html:code>.

To properly set the group owner of <html:code>/etc/at.allow</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/at.allow</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the owner of the at.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_at_allow" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp 0 /etc/at.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_at_allow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/at.allow
  stat:
    path: /etc/at.allow
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/at.allow
  file:
    path: /etc/at.allow
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_at_allow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_at_allow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" severity="medium">
              <xccdf-1.2:title>Verify Group Who Owns /etc/cron.allow file</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>/etc/cron.allow</html:code> exists, it must be group-owned by <html:code>root</html:code>.

To properly set the group owner of <html:code>/etc/cron.allow</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/cron.allow</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_cron_allow" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp 0 /etc/cron.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_cron_allow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.allow
  stat:
    path: /etc/cron.allow
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/cron.allow
  file:
    path: /etc/cron.allow
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_cron_allow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_cron_allow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" severity="medium">
              <xccdf-1.2:title>Verify User Who Owns /etc/cron.allow file</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>/etc/cron.allow</html:code> exists, it must be owned by <html:code>root</html:code>.

To properly set the owner of <html:code>/etc/cron.allow</html:code>, run the command:
<html:pre>$ sudo chown root /etc/cron.allow </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_cron_allow" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /etc/cron.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_cron_allow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.allow
  stat:
    path: /etc/cron.allow
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/cron.allow
  file:
    path: /etc/cron.allow
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_cron_allow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_cron_allow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_at_allow" severity="medium">
              <xccdf-1.2:title>Verify Permissions on /etc/at.allow file</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>/etc/at.allow</html:code> exists, it must have permissions <html:code>0640</html:code>
or more restrictive.


To properly set the permissions of <html:code>/etc/at.allow</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /etc/at.allow</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the permissions of the at.allow file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_at_allow" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xws,o-xwrt /etc/at.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_at_allow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/at.allow
  stat:
    path: /etc/at.allow
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/at.allow
  file:
    path: /etc/at.allow
    mode: u-xs,g-xws,o-xwrt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_at_allow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_at_allow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_cron_allow" severity="medium">
              <xccdf-1.2:title>Verify Permissions on /etc/cron.allow file</xccdf-1.2:title>
              <xccdf-1.2:description>If <html:code>/etc/cron.allow</html:code> exists, it must have permissions <html:code>0640</html:code>
or more restrictive.


To properly set the permissions of <html:code>/etc/cron.allow</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /etc/cron.allow</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If the permissions of the cron.allow file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_cron_allow" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xws,o-xwrt /etc/cron.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_cron_allow" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.allow
  stat:
    path: /etc/cron.allow
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/cron.allow
  file:
    path: /etc/cron.allow
    mode: u-xs,g-xws,o-xwrt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_cron_allow:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_cron_allow_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_deprecated">
          <xccdf-1.2:title>Deprecated services</xccdf-1.2:title>
          <xccdf-1.2:description>Some deprecated software services impact the overall system security due to their behavior (leak of
confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed" severity="high">
            <xccdf-1.2:title>Uninstall the inet-based telnet server</xccdf-1.2:title>
            <xccdf-1.2:description>The inet-based telnet daemon should be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>telnet</html:code> allows clear text communications, and does not protect any
data transmission between client and server. Any confidential data can be
listened and no integrity checking is made.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove inetutils-telnetd
#	   from the system, and may remove any packages
#	   that depend on inetutils-telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "inetutils-telnetd" ; then
yum remove -y "inetutils-telnetd"
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure inetutils-telnetd is removed
  package:
    name: inetutils-telnetd
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_inetutils-telnetd_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_inetutils-telnetd

class remove_inetutils-telnetd {
  package { 'inetutils-telnetd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_inetutils-telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=inetutils-telnetd
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_inetutils-telnetd_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nis_removed" severity="low">
            <xccdf-1.2:title>Uninstall the nis package</xccdf-1.2:title>
            <xccdf-1.2:description>The support for Yellowpages should not be installed unless it is required.</xccdf-1.2:description>
            <xccdf-1.2:rationale>NIS is the historical SUN service for central account management, more and more replaced by LDAP.
NIS does not support efficiently security constraints, ACL, etc. and should not be used.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove nis
#	   from the system, and may remove any packages
#	   that depend on nis. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "nis" ; then
yum remove -y "nis"
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure nis is removed
  package:
    name: nis
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_nis_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_nis

class remove_nis {
  package { 'nis':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nis_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=nis
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_nis_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed" severity="high">
            <xccdf-1.2:title>Uninstall the ssl compliant telnet server</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>telnet</html:code> daemon, even with ssl support, should be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>telnet</html:code>, even with ssl support, should not be installed.
When remote shell is required, up-to-date ssh daemon can be used.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove telnetd-ssl
#	   from the system, and may remove any packages
#	   that depend on telnetd-ssl. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnetd-ssl" ; then
yum remove -y "telnetd-ssl"
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnetd-ssl is removed
  package:
    name: telnetd-ssl
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_telnetd-ssl_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnetd-ssl

class remove_telnetd-ssl {
  package { 'telnetd-ssl':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_telnetd-ssl_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=telnetd-ssl
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_telnetd-ssl_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_telnetd_removed" severity="high">
            <xccdf-1.2:title>Uninstall the telnet server</xccdf-1.2:title>
            <xccdf-1.2:description>The telnet daemon should be uninstalled.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>telnet</html:code> allows clear text communications, and does not protect
any data transmission between client and server. Any confidential data
can be listened and no integrity checking is made.'</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove telnetd
#	   from the system, and may remove any packages
#	   that depend on telnetd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnetd" ; then
yum remove -y "telnetd"
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnetd is removed
  package:
    name: telnetd
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_telnetd_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnetd

class remove_telnetd {
  package { 'telnetd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_telnetd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=telnetd
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_telnetd_removed:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp">
          <xccdf-1.2:title>DHCP</xccdf-1.2:title>
          <xccdf-1.2:description>The Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
<html:br/>
      <html:br/>
This guide recommends configuring networking on clients by manually editing
the appropriate files under <html:code>/etc/sysconfig</html:code>.  Use of DHCP can make client 
systems vulnerable to compromise by rogue DHCP servers, and should be avoided 
unless necessary.  If using DHCP is necessary, however, there are best practices 
that should be followed to minimize security risk.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp_client_configuration">
            <xccdf-1.2:title>Configure DHCP Client if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If DHCP must be used, then certain configuration changes can
minimize the amount of information it receives and applies from the network,
and thus the amount of incorrect information a rogue DHCP server could
successfully distribute.  For more information on configuring dhclient, see the
<html:code>dhclient(8)</html:code> and <html:code>dhclient.conf(5)</html:code> man pages.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dhcp_client_restrict_options" severity="unknown">
              <xccdf-1.2:title>Minimize the DHCP-Configured Options</xccdf-1.2:title>
              <xccdf-1.2:description>Create the file <html:code>/etc/dhcp/dhclient.conf</html:code>, and add an
appropriate setting for each of the ten configuration settings which can be
obtained via DHCP. For each setting, do one of the following:
<html:br/>
If the setting should <html:i>not</html:i> be configured remotely by the DHCP server,
select an appropriate static value, and add the line:
<html:pre>supersede <html:code>setting value</html:code>;</html:pre>
If the setting should be configured remotely by the DHCP server, add the lines:
<html:pre>request <html:code>setting</html:code>;
require <html:code>setting</html:code>;</html:pre>
For example, suppose the DHCP server should provide only the IP address itself
and the subnet mask. Then the entire file should look like:
<html:pre>supersede domain-name "example.com";
supersede domain-name-servers 192.168.1.2;
supersede nis-domain "";
supersede nis-servers "";
supersede ntp-servers "ntp.example.com ";
supersede routers 192.168.1.1;
supersede time-offset -18000;
request subnet-mask;
require subnet-mask;</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">In this example, the options nis-servers and
nis-domain are set to empty strings, on the assumption that the deprecated NIS
protocol is not in use. It is necessary to supersede settings for unused
services so that they cannot be set by a hostile DHCP server. If an option is
set to an empty string, dhclient will typically not attempt to configure the
service.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>By default, the DHCP client program, dhclient, requests and applies
ten configuration options (in addition to the IP address) from the DHCP server.
subnet-mask, broadcast-address, time-offset, routers, domain-name,
domain-name-servers, host-name, nis-domain, nis-servers, and ntp-servers.  Many
of the options requested and applied by dhclient may be the same for every
system on a network. It is recommended that almost all configuration options be
assigned statically, and only options which must vary on a host-by-host basis
be assigned via DHCP. This limits the damage which can be done by a rogue DHCP
server.  If appropriate for your site, it is also possible to supersede the
host-name directive in <html:code>/etc/dhcp/dhclient.conf</html:code>, establishing a static
hostname for the system. However, dhclient does not use the host name option
provided by the DHCP server (instead using the value provided by a reverse DNS
lookup).</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp_server_configuration">
            <xccdf-1.2:title>Configure DHCP Server</xccdf-1.2:title>
            <xccdf-1.2:description>If the system must act as a DHCP server, the configuration
information it serves should be minimized. Also, support for other protocols
and DNS-updating schemes should be explicitly disabled unless needed. The
configuration file for dhcpd is called <html:code>/etc/dhcp/dhcpd.conf</html:code>. The file
begins with a number of global configuration options. The remainder of the file
is divided into sections, one for each block of addresses offered by dhcpd,
each of which contains configuration options specific to that address
block.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_dhcp_server_minimize_served_info" severity="unknown">
              <xccdf-1.2:title>Minimize Served Information</xccdf-1.2:title>
              <xccdf-1.2:description>Edit /etc/dhcp/dhcpd.conf. Examine each address range section within
the file, and ensure that the following options are not defined unless there is
an operational need to provide this information via DHCP:
<html:pre>option domain-name
option domain-name-servers
option nis-domain
option nis-servers
option ntp-servers
option routers
option time-offset</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">By default, the Red Hat Enterprise Linux client installation uses DHCP
to request much of the above information from the DHCP server. In particular,
domain-name, domain-name-servers, and routers are configured via DHCP.  These
settings are typically necessary for proper network functionality, but are also
usually static across systems at a given site.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Because the configuration information provided by the DHCP server
could be maliciously provided to clients by a rogue DHCP server, the amount of
information provided via DHCP should be minimized. Remove these definitions
from the DHCP server configuration to ensure that legitimate clients do not
unnecessarily rely on DHCP for this information.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_server">
            <xccdf-1.2:title>Disable DHCP Server</xccdf-1.2:title>
            <xccdf-1.2:description>The DHCP server <html:code>dhcpd</html:code> is not installed or activated by
default. If the software was installed and activated, but the
system does not need to act as a DHCP server, it should be disabled
and removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_dhcp_removed" severity="medium">
              <xccdf-1.2:title>Uninstall DHCP Server Package</xccdf-1.2:title>
              <xccdf-1.2:description>If the system does not need to act as a DHCP server,
the dhcp package can be uninstalled.

The <html:code>dhcp-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase dhcp-server</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing the DHCP server ensures that it cannot be easily or
accidentally reactivated and disrupt network operation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_dhcp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove dhcp
#	   from the system, and may remove any packages
#	   that depend on dhcp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "dhcp" ; then
yum remove -y "dhcp"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_dhcp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure dhcp is removed
  package:
    name: dhcp
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_dhcp_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_dhcp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_dhcp

class remove_dhcp {
  package { 'dhcp':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_dhcp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=dhcp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_dhcp_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_dhcp_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns">
          <xccdf-1.2:title>DNS Server</xccdf-1.2:title>
          <xccdf-1.2:description>Most organizations have an operational need to run at
least one nameserver. However, there are many common attacks
involving DNS server software, and this server software should
be disabled on any system
on which it is not needed.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dns_server">
            <xccdf-1.2:title>Disable DNS Server</xccdf-1.2:title>
            <xccdf-1.2:description>DNS software should be disabled on any systems which does not
need to be a nameserver. Note that the BIND DNS server software is
not installed on Oracle Linux 9 by default. The remainder of this section
discusses secure configuration of systems which must be
nameservers.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_bind_removed" severity="low">
              <xccdf-1.2:title>Uninstall bind Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>named</html:code> service is provided by the <html:code>bind</html:code> package.
The <html:code>bind</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase bind</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If there is no need to make DNS server software available,
removing it provides a safeguard against its activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove bind
#	   from the system, and may remove any packages
#	   that depend on bind. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "bind" ; then
yum remove -y "bind"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure bind is removed
  package:
    name: bind
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_bind_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_bind

class remove_bind {
  package { 'bind':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_bind_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=bind
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_bind_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_bind_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_fapolicyd">
          <xccdf-1.2:title>Application Whitelisting Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>Fapolicyd (File Access Policy Daemon) implements application whitelisting
to decide file access rights. Applications that are known via a reputation
source are allowed access while unknown applications are not. The daemon
makes use of the kernel's <html:code>fanotify</html:code> interface to determine file access rights.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" severity="medium">
            <xccdf-1.2:title>Install fapolicyd Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>fapolicyd</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install fapolicyd</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001774</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(22)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000370-GPOS-00155</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00230</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000340</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271506r1091230_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>fapolicyd</html:code> (File Access Policy Daemon)
implements application whitelisting to decide file access rights.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "fapolicyd" ; then
    yum install -y "fapolicyd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000340
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(22)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_fapolicyd_installed

- name: Ensure fapolicyd is installed
  package:
    name: fapolicyd
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000340
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(22)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_fapolicyd_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_fapolicyd

class install_fapolicyd {
  package { 'fapolicyd':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_fapolicyd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=fapolicyd
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_fapolicyd_installed">
[[packages]]
name = "fapolicyd"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_fapolicyd_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_fapolicyd_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_fapolicyd_enabled" severity="medium">
            <xccdf-1.2:title>Enable the File Access Policy Service</xccdf-1.2:title>
            <xccdf-1.2:description>The File Access Policy service should be enabled.

The <html:code>fapolicyd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable fapolicyd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001774</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(22)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000370-GPOS-00155</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00230</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000341</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271507r1091233_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>fapolicyd</html:code> service (File Access Policy Daemon)
implements application whitelisting to decide file access rights.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_fapolicyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'fapolicyd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'fapolicyd.service'
fi
"$SYSTEMCTL_EXEC" enable 'fapolicyd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_fapolicyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000341
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(22)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_fapolicyd_enabled

- name: Enable the File Access Policy Service - Enable service fapolicyd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable the File Access Policy Service - Enable Service fapolicyd
    ansible.builtin.systemd:
      name: fapolicyd
      enabled: true
      state: started
      masked: false
    when:
    - '"fapolicyd" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000341
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(22)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_fapolicyd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_fapolicyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_fapolicyd

class enable_fapolicyd {
  service {'fapolicyd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_fapolicyd_enabled">
[customizations.services]
enabled = ["fapolicyd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_fapolicyd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_fapolicyd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_fapolicy_default_deny" severity="medium">
            <xccdf-1.2:title>Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.</xccdf-1.2:title>
            <xccdf-1.2:description>The Fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and to prevent unauthorized software from running.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001764</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7 (2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7 (5) (b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6 b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000370-GPOS-00155</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software.
Using only authorized software decreases risk by limiting the number of potential vulnerabilities. Verification of whitelisted software occurs prior to execution or at system startup.

Proceed with caution with enforcing the use of this daemon.
Improper configuration may render the system non-functional.
The "fapolicyd" API is not namespace aware and can cause issues when launching or running containers.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="fapolicy_default_deny" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &gt; /etc/fapolicyd/rules.d/99-deny-everything.rules &lt;&lt; EOF
deny perm=any all : all
EOF

chmod 644 /etc/fapolicyd/rules.d/99-deny-everything.rules
chgrp fapolicyd /etc/fapolicyd/rules.d/99-deny-everything.rules

if [ -e "/etc/fapolicyd/fapolicyd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*permissive\s*=\s*/Id" "/etc/fapolicyd/fapolicyd.conf"
else
    touch "/etc/fapolicyd/fapolicyd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/fapolicyd/fapolicyd.conf"

cp "/etc/fapolicyd/fapolicyd.conf" "/etc/fapolicyd/fapolicyd.conf.bak"
# Insert at the end of the file
printf '%s\n' "permissive = 0" &gt;&gt; "/etc/fapolicyd/fapolicyd.conf"
# Clean up after ourselves.
rm "/etc/fapolicyd/fapolicyd.conf.bak"

systemctl restart fapolicyd

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="fapolicy_default_deny" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6 b
  - NIST-800-53-CM-7 (2)
  - NIST-800-53-CM-7 (5) (b)
  - fapolicy_default_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy
    to Allow the Execution of Authorized Software Programs. - Ensure a Final Rule
    Denying Everything
  ansible.builtin.copy:
    content: |
      deny perm=any all : all
    dest: /etc/fapolicyd/rules.d/99-deny-everything.rules
    owner: root
    group: fapolicyd
    mode: '0644'
  register: result_fapolicyd_final_rule
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6 b
  - NIST-800-53-CM-7 (2)
  - NIST-800-53-CM-7 (5) (b)
  - fapolicy_default_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy
    to Allow the Execution of Authorized Software Programs. - Ensure fapolicyd is
    Not Permissive
  ansible.builtin.lineinfile:
    path: /etc/fapolicyd/fapolicyd.conf
    regexp: ^(permissive\s*=).*$
    line: \1 0
    backrefs: true
  register: result_fapolicyd_enforced
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6 b
  - NIST-800-53-CM-7 (2)
  - NIST-800-53-CM-7 (5) (b)
  - fapolicy_default_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy
    to Allow the Execution of Authorized Software Programs. - Restart fapolicyd If
    Permissive Mode or Final Rule is Changed
  ansible.builtin.service:
    name: fapolicyd
    state: restarted
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - result_fapolicyd_final_rule is changed or result_fapolicyd_enforced is changed
  tags:
  - NIST-800-53-CM-6 b
  - NIST-800-53-CM-7 (2)
  - NIST-800-53-CM-7 (5) (b)
  - fapolicy_default_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-fapolicy_default_deny:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-fapolicy_default_deny_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_fapolicyd_prevent_home_folder_access" severity="medium">
            <xccdf-1.2:title>fapolicyd Must be Configured to Limit Access to Users Home Folders</xccdf-1.2:title>
            <xccdf-1.2:description>fapolicyd needs be configured so that users cannot give access to their home folders to other users.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule is deprecated and there is no replacement at this time.
Previous versions of this rule provided fixtext that would cause fapolicyd not to start.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6 b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00230</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Users' home directories/folders may contain information of a sensitive nature.
Non-privileged users should coordinate any sharing of information with a System Administrator (SA) through shared resources.
fapolicyd can confine users to their home directory, not allowing them to make any changes outside of their own home directories.
Confining users to their home directory will minimize the risk of sharing information.</xccdf-1.2:rationale>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp">
          <xccdf-1.2:title>FTP Server</xccdf-1.2:title>
          <xccdf-1.2:description>FTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
<html:br/>
      <html:br/>
However, there are some FTP server configurations which may
be appropriate for some environments, particularly those which
allow only read-only anonymous access as a means of downloading
data available to the public.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_ftp_removed" severity="low">
            <xccdf-1.2:title>Remove ftp Package</xccdf-1.2:title>
            <xccdf-1.2:description>FTP (File Transfer Protocol) is a traditional and widely used standard tool for
transferring files between a server and clients over a network, especially where no
authentication is necessary (permits anonymous users to connect to a server).
<html:br/>
The <html:code>ftp</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase ftp</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>FTP does not protect the confidentiality of data or authentication credentials. It
is recommended SFTP be used if file transfer is required. Unless there is a need
to run the system as a FTP server (for example, to allow anonymous downloads), it is
recommended that the package be removed to reduce the potential attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_ftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove ftp
#	   from the system, and may remove any packages
#	   that depend on ftp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "ftp" ; then
yum remove -y "ftp"
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_ftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure ftp is removed
  package:
    name: ftp
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_ftp_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_ftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_ftp

class remove_ftp {
  package { 'ftp':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_ftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=ftp
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_ftp_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_ftp_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_vsftpd">
            <xccdf-1.2:title>Disable vsftpd if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>To minimize attack surface, disable vsftpd if at all
possible.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" severity="high">
              <xccdf-1.2:title>Uninstall vsftpd Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>vsftpd</html:code> package can be removed with the following command: <html:pre> $ sudo yum erase vsftpd</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1).1(v)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7.1(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271462r1091098_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing the <html:code>vsftpd</html:code> package decreases the risk of its
accidental activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove vsftpd
#	   from the system, and may remove any packages
#	   that depend on vsftpd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "vsftpd" ; then
yum remove -y "vsftpd"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure vsftpd is removed
  package:
    name: vsftpd
    state: absent
  tags:
  - DISA-STIG-OL09-00-000130
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-CM-7.1(ii)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(1).1(v)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_vsftpd_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_vsftpd

class remove_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_vsftpd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=vsftpd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_vsftpd_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd">
            <xccdf-1.2:title>Configure vsftpd to Provide FTP Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>The primary vsftpd configuration file is
<html:code>/etc/vsftpd.conf</html:code>, if that file exists, or
<html:code>/etc/vsftpd/vsftpd.conf</html:code> if it does not.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_configure_firewall" severity="unknown">
              <xccdf-1.2:title>Configure Firewalls to Protect the FTP Server</xccdf-1.2:title>
              <xccdf-1.2:description>By default, <html:code>iptables</html:code>
blocks access to the ports used by the web server.

To configure <html:code>iptables</html:code> to allow port 21 traffic, one must edit
<html:code>/etc/sysconfig/iptables</html:code> and
<html:code>/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
<html:pre>-A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT</html:pre>
Edit the file <html:code>/etc/sysconfig/iptables-config</html:code>. Ensure that the space-separated list of modules contains
the FTP connection tracking module:
<html:pre>IPTABLES_MODULES="ip_conntrack_ftp"</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale>These settings configure the firewall to allow connections to an FTP server.</xccdf-1.2:rationale>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_restrict_users">
              <xccdf-1.2:title>Restrict the Set of Users Allowed to Access FTP</xccdf-1.2:title>
              <xccdf-1.2:description>This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to
do this entirely due to legacy applications, how to restrict insecure FTP login to only those users who have an
identified need for this access.</xccdf-1.2:description>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ftp_limit_users" severity="unknown">
                <xccdf-1.2:title>Limit Users Allowed FTP Access if Necessary</xccdf-1.2:title>
                <xccdf-1.2:description>If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options:
<html:pre>userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO</html:pre>
Edit the file <html:code>/etc/vsftp.ftpusers</html:code>. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name:
<html:pre>USERNAME</html:pre>
If anonymous access is also required, add the anonymous usernames to <html:code>/etc/vsftp.ftpusers</html:code> as well.
<html:pre>anonymous
ftp</html:pre>
        </xccdf-1.2:description>
                <xccdf-1.2:rationale>Historically, the file <html:code>/etc/ftpusers</html:code> contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option <html:code>userlist deny=NO</html:code> is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified.</xccdf-1.2:rationale>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_imap">
          <xccdf-1.2:title>IMAP and POP3 Server</xccdf-1.2:title>
          <xccdf-1.2:description>Dovecot provides IMAP and POP3 services. It is not
installed by default. The project page at 
    <html:a href="http://www.dovecot.org">http://www.dovecot.org</html:a>
contains more detailed information about Dovecot
configuration.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_cyrus-imapd">
            <xccdf-1.2:title>Disable Cyrus IMAP</xccdf-1.2:title>
            <xccdf-1.2:description>If the system does not need to operate as an IMAP or
POP3 server, the Cyrus IMAP software should be removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_cyrus-imapd_removed" severity="unknown">
              <xccdf-1.2:title>Uninstall cyrus-imapd Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>cyrus-imapd</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase cyrus-imapd</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If there is no need to make the cyrus-imapd software available,
removing it provides a safeguard against its activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_cyrus-imapd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove cyrus-imapd
#	   from the system, and may remove any packages
#	   that depend on cyrus-imapd. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "cyrus-imapd" ; then
yum remove -y "cyrus-imapd"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_cyrus-imapd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure cyrus-imapd is removed
  package:
    name: cyrus-imapd
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_cyrus-imapd_removed
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_cyrus-imapd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_cyrus-imapd

class remove_cyrus-imapd {
  package { 'cyrus-imapd':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_cyrus-imapd_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=cyrus-imapd
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_cyrus-imapd_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_cyrus-imapd_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dovecot">
            <xccdf-1.2:title>Disable Dovecot</xccdf-1.2:title>
            <xccdf-1.2:description>If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_dovecot_removed" severity="unknown">
              <xccdf-1.2:title>Uninstall dovecot Package</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>dovecot</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase dovecot</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_dovecot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove dovecot
#	   from the system, and may remove any packages
#	   that depend on dovecot. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "dovecot" ; then
yum remove -y "dovecot"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_dovecot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure dovecot is removed
  package:
    name: dovecot
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_dovecot_removed
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_dovecot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_dovecot

class remove_dovecot {
  package { 'dovecot':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_dovecot_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=dovecot
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_dovecot_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_dovecot_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mail">
          <xccdf-1.2:title>Mail Server Software</xccdf-1.2:title>
          <xccdf-1.2:description>Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that systems are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<html:br/>
      <html:br/>
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<html:br/>
      <html:br/>
The <html:code>alternatives</html:code> program in Oracle Linux 9 permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, 
    <html:a href="http://www.postfix.org">http://www.postfix.org</html:a>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_postfix_installed" severity="medium">
            <xccdf-1.2:title>The Postfix package is installed</xccdf-1.2:title>
            <xccdf-1.2:description>A mail server is required for sending emails.
The <html:code>postfix</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install postfix</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Emails can be used to notify designated personnel about important
system events such as failures or warnings.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_postfix_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "postfix" ; then
    yum install -y "postfix"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_postfix_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_postfix_installed

- name: Ensure postfix is installed
  package:
    name: postfix
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_postfix_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_postfix_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_postfix

class install_postfix {
  package { 'postfix':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_postfix_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=postfix
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_postfix_installed">
[[packages]]
name = "postfix"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_postfix_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_postfix_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_s-nail_installed" severity="medium">
            <xccdf-1.2:title>The s-nail Package Is Installed</xccdf-1.2:title>
            <xccdf-1.2:description>A mail server is required for sending emails.
The <html:code>s-nail</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install s-nail</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-3(5)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000290</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271495r1091197_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Emails can be used to notify designated personnel about important
system events such as failures or warnings.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_s-nail_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "s-nail" ; then
    yum install -y "s-nail"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_s-nail_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000290
  - NIST-800-53-CM-3(5)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_s-nail_installed

- name: Ensure s-nail is installed
  package:
    name: s-nail
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000290
  - NIST-800-53-CM-3(5)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_s-nail_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_s-nail_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_s-nail

class install_s-nail {
  package { 's-nail':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_s-nail_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=s-nail
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_s-nail_installed">
[[packages]]
name = "s-nail"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_s-nail_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_s-nail_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_sendmail_removed" severity="medium">
            <xccdf-1.2:title>Uninstall Sendmail Package</xccdf-1.2:title>
            <xccdf-1.2:description>Sendmail is not the default mail transfer agent and is
not installed by default.
The <html:code>sendmail</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase sendmail</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000150</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271466r1091110_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The sendmail software was not developed with security in mind and
its design prevents it from being effectively contained by SELinux.  Postfix
should be used instead.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# CAUTION: This remediation script will remove sendmail
#	   from the system, and may remove any packages
#	   that depend on sendmail. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "sendmail" ; then
yum remove -y "sendmail"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000150
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sendmail_removed

- name: Ensure sendmail is removed
  package:
    name: sendmail
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000150
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sendmail_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_sendmail

class remove_sendmail {
  package { 'sendmail':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_sendmail_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=sendmail
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_sendmail_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_postfix_enabled" severity="unknown">
            <xccdf-1.2:title>Enable Postfix Service</xccdf-1.2:title>
            <xccdf-1.2:description>The Postfix mail transfer agent is used for local mail delivery
within the system. The default configuration only listens for connections to
the default SMTP port (port 25) on the loopback interface (127.0.0.1).  It is
recommended to leave this service enabled for local mail delivery.

The <html:code>postfix</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable postfix.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:rationale>Local mail delivery is essential to some system maintenance and
notification tasks.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_postfix_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'postfix.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'postfix.service'
fi
"$SYSTEMCTL_EXEC" enable 'postfix.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_postfix_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_postfix_enabled
  - unknown_severity

- name: Enable Postfix Service - Enable service postfix
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable Postfix Service - Enable Service postfix
    ansible.builtin.systemd:
      name: postfix
      enabled: true
      state: started
      masked: false
    when:
    - '"postfix" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_postfix_enabled
  - unknown_severity
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_postfix_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_postfix

class enable_postfix {
  service {'postfix':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_postfix_enabled">
[customizations.services]
enabled = ["postfix"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_postfix_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_postfix_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_client">
            <xccdf-1.2:title>Configure SMTP For Mail Clients</xccdf-1.2:title>
            <xccdf-1.2:description>This section discusses settings for Postfix in a submission-only
e-mail configuration.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" type="string">
              <xccdf-1.2:title>Postfix Network Interfaces</xccdf-1.2:title>
              <xccdf-1.2:description>The setting for inet_interfaces in /etc/postfix/main.cf</xccdf-1.2:description>
              <xccdf-1.2:value selector="loopback-only">loopback-only</xccdf-1.2:value>
              <xccdf-1.2:value>loopback-only</xccdf-1.2:value>
              <xccdf-1.2:value selector="localhost">localhost</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_relayhost" type="string">
              <xccdf-1.2:title>Postfix relayhost</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the host all outbound email should be routed into.</xccdf-1.2:description>
              <xccdf-1.2:value>smtp.$mydomain</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" type="string" interactive="true">
              <xccdf-1.2:title>Postfix Root Mail Alias</xccdf-1.2:title>
              <xccdf-1.2:description>Specify an email address (string) for a root mail alias.</xccdf-1.2:description>
              <xccdf-1.2:value>change_me@localhost</xccdf-1.2:value>
              <xccdf-1.2:value selector="mil_sysadmin">system.administrator@mail.mil</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias" severity="medium">
              <xccdf-1.2:title>Configure System to Forward All Mail For The Root Account</xccdf-1.2:title>
              <xccdf-1.2:description>Make sure that mails delivered to root user are forwarded to a monitored
email address. Make sure that the address
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/> is a valid email address
reachable from the system in question. Use the following command to
configure the alias:
<html:pre>$ sudo echo "root: <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" use="legacy"/>" &gt;&gt; /etc/aliases
$ sudo newaliases</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R75</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271744r1091944_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>A number of system services utilize email messages sent to the root user to
notify system administrators of active or impending issues.  These messages must
be forwarded to at least one monitored email address.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_postfix_root_mail_alias:var:1" value-id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-postfix_client_configure_mail_alias:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias_postmaster" severity="medium">
              <xccdf-1.2:title>Configure System to Forward All Mail From Postmaster to The Root Account</xccdf-1.2:title>
              <xccdf-1.2:description>Verify the administrators are notified in the event of an audit processing failure.
Check that the "/etc/aliases" file has a defined value for "root".
<html:pre>$ sudo grep "postmaster:\s*root$" /etc/aliases

postmaster: root</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5.1(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000815</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271589r1091479_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>It is critical for the appropriate personnel to be aware if a system is at risk of failing to
process audit logs as required. Without this notification, the security personnel may be
unaware of an impending failure of the audit capability, and system operation may be adversely
affected.

Audit processing failures include software/hardware errors, failures in the audit capturing
mechanisms, and audit storage capacity being reached or exceeded.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="postfix_client_configure_mail_alias_postmaster" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/aliases" ] ; then
    
    LC_ALL=C sed -i "/^\s*postmaster\s*:\s*/Id" "/etc/aliases"
else
    touch "/etc/aliases"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/aliases"

cp "/etc/aliases" "/etc/aliases.bak"
# Insert at the end of the file
printf '%s\n' "postmaster: root" &gt;&gt; "/etc/aliases"
# Clean up after ourselves.
rm "/etc/aliases.bak"

if [ -f /usr/bin/newaliases ]; then
    newaliases
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="postfix_client_configure_mail_alias_postmaster" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000815
  - NIST-800-53-AU-5(a)
  - NIST-800-53-AU-5.1(ii)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_client_configure_mail_alias_postmaster

- name: Configure System to Forward All Mail From Postmaster to The Root Account
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/aliases
      create: true
      regexp: (?i)^\s*postmaster\s*:\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/aliases
    lineinfile:
      path: /etc/aliases
      create: true
      regexp: (?i)^\s*postmaster\s*:\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/aliases
    lineinfile:
      path: /etc/aliases
      create: true
      regexp: (?i)^\s*postmaster\s*:\s*
      line: 'postmaster: root'
      state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000815
  - NIST-800-53-AU-5(a)
  - NIST-800-53-AU-5.1(ii)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_client_configure_mail_alias_postmaster

- name: Check if newaliases command is available
  ansible.builtin.stat:
    path: /usr/bin/newaliases
  register: result_newaliases_present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000815
  - NIST-800-53-AU-5(a)
  - NIST-800-53-AU-5.1(ii)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_client_configure_mail_alias_postmaster

- name: Update postfix aliases
  ansible.builtin.command:
    cmd: newaliases
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - result_newaliases_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-000815
  - NIST-800-53-AU-5(a)
  - NIST-800-53-AU-5.1(ii)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_client_configure_mail_alias_postmaster
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-postfix_client_configure_mail_alias_postmaster:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_client_configure_relayhost" severity="medium">
              <xccdf-1.2:title>Configure System to Forward All Mail through a specific host</xccdf-1.2:title>
              <xccdf-1.2:description>Set up a relay host that will act as a gateway for all outbound email.
Edit the file <html:code>/etc/postfix/main.cf</html:code> to ensure that only the following
<html:code>relayhost</html:code> line appears:
<html:pre>relayhost = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_relayhost" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale>A central outbound email location ensures messages sent from any network host
can be audited for potential unexpected content.  Tooling on the central server
may help prevent spam or viruses from being delivered.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_postfix"/>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-postfix_client_configure_relayhost_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled" severity="medium">
              <xccdf-1.2:title>Disable Postfix Network Listening</xccdf-1.2:title>
              <xccdf-1.2:description>Edit the file <html:code>/etc/postfix/main.cf</html:code> to ensure that only the following
<html:code>inet_interfaces</html:code> line appears:
<html:pre>inet_interfaces = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R74</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This ensures <html:code>postfix</html:code> accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_postfix"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="postfix_network_listening_disabled"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q postfix; }; then

var_postfix_inet_interfaces='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" use="legacy"/>'


if [ -e "/etc/postfix/main.cf" ] ; then
    
    LC_ALL=C sed -i "/^\s*inet_interfaces\s\+=\s\+/Id" "/etc/postfix/main.cf"
else
    touch "/etc/postfix/main.cf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/postfix/main.cf"

cp "/etc/postfix/main.cf" "/etc/postfix/main.cf.bak"
# Insert at the end of the file
printf '%s\n' "inet_interfaces=$var_postfix_inet_interfaces" &gt;&gt; "/etc/postfix/main.cf"
# Clean up after ourselves.
rm "/etc/postfix/main.cf.bak"

systemctl restart postfix

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="postfix_network_listening_disabled" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: XCCDF Value var_postfix_inet_interfaces # promote to variable
  set_fact:
    var_postfix_inet_interfaces: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" use="legacy"/>
  tags:
    - always

- name: Gather list of packages
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_network_listening_disabled
  - restrict_strategy

- name: Make changes to Postfix configuration file
  lineinfile:
    path: /etc/postfix/main.cf
    create: false
    regexp: (?i)^inet_interfaces\s*=\s.*
    line: inet_interfaces = {{ var_postfix_inet_interfaces }}
    state: present
    insertafter: ^inet_interfaces\s*=\s.*
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"postfix" in ansible_facts.packages'
  - '"postfix" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_network_listening_disabled
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_postfix_inet_interfaces:var:1" value-id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-postfix_network_listening_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-postfix_network_listening_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_harden_os">
            <xccdf-1.2:title>Configure Operating System to Protect Mail Server</xccdf-1.2:title>
            <xccdf-1.2:description>The guidance in this section is appropriate for any host which is
operating as a site MTA, whether the mail server runs using Sendmail, Postfix,
or some other software.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#package_postfix"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_cfg">
              <xccdf-1.2:title>Configure Postfix if Necessary</xccdf-1.2:title>
              <xccdf-1.2:description>Postfix stores its configuration files in the directory
/etc/postfix by default. The primary configuration file is
<html:code>/etc/postfix/main.cf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay">
                <xccdf-1.2:title>Control Mail Relaying</xccdf-1.2:title>
                <xccdf-1.2:description>Postfix's mail relay controls are implemented with the help of the
smtpd recipient restrictions option, which controls the restrictions placed on
the SMTP dialogue once the sender and recipient envelope addresses are known.
The guidance in the following sections should be applied to all systems. If
there are systems which must be allowed to relay mail, but which cannot be
trusted to relay unconditionally, configure SMTP AUTH with SSL support.</xccdf-1.2:description>
                <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay" severity="medium">
                  <xccdf-1.2:title>Prevent Unrestricted Mail Relaying</xccdf-1.2:title>
                  <xccdf-1.2:description>Modify the <html:pre>/etc/postfix/main.cf</html:pre> file to restrict client connections
to the local network with the following command:
<html:pre>$ sudo postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'</html:pre>
         </xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002425</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271763r1092001_rule</xccdf-1.2:reference>
                  <xccdf-1.2:rationale>If unrestricted mail relaying is permitted, unauthorized senders could use this
host as a mail relay for the purpose of sending spam or other unauthorized
activity.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="#package_postfix"/>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="postfix_prevent_unrestricted_relay"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q postfix; then

if ! grep -q ^smtpd_client_restrictions /etc/postfix/main.cf; then
	echo "smtpd_client_restrictions = permit_mynetworks,reject" &gt;&gt; /etc/postfix/main.cf
else
	sed -i "s/^smtpd_client_restrictions.*/smtpd_client_restrictions = permit_mynetworks,reject/g" /etc/postfix/main.cf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="postfix_prevent_unrestricted_relay" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002425
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_prevent_unrestricted_relay
  - restrict_strategy

- name: Prevent Unrestricted Mail Relaying
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/postfix/main.cf
      create: true
      regexp: (?i)^[ \t]*smtpd_client_restrictions\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/postfix/main.cf
    lineinfile:
      path: /etc/postfix/main.cf
      create: true
      regexp: (?i)^[ \t]*smtpd_client_restrictions\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/postfix/main.cf
    lineinfile:
      path: /etc/postfix/main.cf
      create: true
      regexp: (?i)^[ \t]*smtpd_client_restrictions\s*=\s*
      line: smtpd_client_restrictions = permit_mynetworks,reject
      state: present
  when:
  - '"postfix" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002425
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_prevent_unrestricted_relay
  - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-postfix_prevent_unrestricted_relay:def:1"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-postfix_prevent_unrestricted_relay_ocil:questionnaire:1"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_and_rpc">
          <xccdf-1.2:title>NFS and RPC</xccdf-1.2:title>
          <xccdf-1.2:description>The Network File System is a popular distributed filesystem for
the Unix environment, and is very widely deployed.  This section discusses the
circumstances under which it is possible to disable NFS and its dependencies,
and then details steps which should be taken to secure
NFS's configuration. This section is relevant to systems operating as NFS
clients, as well as to those operating as NFS servers.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" severity="low">
            <xccdf-1.2:title>Uninstall nfs-utils Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>nfs-utils</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase nfs-utils</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000100</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271456r1091080_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>nfs-utils</html:code> provides a daemon for the kernel NFS server and related tools. This
package also contains the <html:code>showmount</html:code> program. <html:code>showmount</html:code> queries the mount
daemon on a remote host for information about the Network File System (NFS) server on the
remote host. For example, <html:code>showmount</html:code> can display the clients which are mounted on
that host.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove nfs-utils
#	   from the system, and may remove any packages
#	   that depend on nfs-utils. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "nfs-utils" ; then
yum remove -y "nfs-utils"
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure nfs-utils is removed
  package:
    name: nfs-utils
    state: absent
  tags:
  - DISA-STIG-OL09-00-000100
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_nfs-utils_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_nfs-utils

class remove_nfs-utils {
  package { 'nfs-utils':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_nfs-utils_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=nfs-utils
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_nfs-utils_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_clients">
            <xccdf-1.2:title>Configure NFS Clients</xccdf-1.2:title>
            <xccdf-1.2:description>The steps in this section are appropriate for systems which operate as NFS clients.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mounting_remote_filesystems">
              <xccdf-1.2:title>Mount Remote Filesystems with Restrictive Options</xccdf-1.2:title>
              <xccdf-1.2:description>Edit the file <html:code>/etc/fstab</html:code>. For each filesystem whose type
(column 3) is <html:code>nfs</html:code> or <html:code>nfs4</html:code>, add the text
<html:code>,nodev,nosuid</html:code> to the list of mount options in column 4. If
appropriate, also add <html:code>,noexec</html:code>.
<html:br/>
        <html:br/>
See the section titled "Restrict Partition Mount Options" for a description of
the effects of these options. In general, execution of files mounted via NFS
should be considered risky because of the possibility that an adversary could
intercept the request and substitute a malicious file. Allowing setuid files to
be executed from remote servers is particularly risky, both for this reason and
because it requires the clients to extend root-level trust to the NFS
server.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems" severity="medium">
                <xccdf-1.2:title>Mount Remote Filesystems with Kerberos Security</xccdf-1.2:title>
                <xccdf-1.2:description>Add the <html:code>sec=krb5:krb5i:krb5p</html:code> option to the fourth column of <html:code>/etc/fstab</html:code> for the line which controls mounting of
any NFS mounts.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(8)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002010</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271640r1091632_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>When an NFS server is configured to use AUTH_SYS a selected userid and groupid are used to handle
requests from the remote user. The userid and groupid could mistakenly or maliciously be set
incorrectly. The AUTH_GSS method of authentication uses certificates on the server and client
systems to more securely authenticate the remote mount request.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#nfs_mount_defined"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_krb_sec_remote_filesystems"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

vfstype_points=()
readarray -t vfstype_points &lt; &lt;(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

for vfstype_point in "${vfstype_points[@]}"
do
    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|sec=krb5:krb5i:krb5p)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="nfs4"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " ${vfstype_point//\\/\\\\} nfs4 defaults,${previous_mount_opts}sec=krb5:krb5i:krb5p 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "sec=krb5:krb5i:krb5p"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,sec=krb5:krb5i:krb5p|" /etc/fstab
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_krb_sec_remote_filesystems" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002010
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_krb_sec_remote_filesystems
  - no_reboot_needed

- name: Get nfs and nfs4 mount points, that don't have sec=krb5:krb5i:krb5p
  command: findmnt --fstab --types nfs,nfs4 -O nosec=krb5:krb5i:krb5p -n -P
  register: points_register
  check_mode: false
  changed_when: false
  failed_when: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002010
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_krb_sec_remote_filesystems
  - no_reboot_needed

- name: Add sec=krb5:krb5i:krb5p to nfs and nfs4 mount points
  mount:
    path: '{{ item | regex_search(''TARGET="([^"]+)"'',''\1'') | first }}'
    src: '{{ item | regex_search(''SOURCE="([^"]+)"'',''\1'') | first }}'
    fstype: '{{ item | regex_search(''FSTYPE="([^"]+)"'',''\1'') | first }}'
    state: present
    opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},sec=krb5:krb5i:krb5p'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (points_register.stdout | length &gt; 0) and '\\x09' not in item
  with_items: '{{ points_register.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002010
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_krb_sec_remote_filesystems
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_krb_sec_remote_filesystems:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_krb_sec_remote_filesystems_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems" severity="medium">
                <xccdf-1.2:title>Mount Remote Filesystems with nodev</xccdf-1.2:title>
                <xccdf-1.2:description>Add the <html:code>nodev</html:code> option to the fourth column of <html:code>/etc/fstab</html:code> for the line which controls mounting of
any NFS mounts.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002011</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271641r1091635_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>Legitimate device files should only exist in the /dev directory. NFS mounts
should not present device files to users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#nfs_mount_defined"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nodev_remote_filesystems"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

vfstype_points=()
readarray -t vfstype_points &lt; &lt;(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

for vfstype_point in "${vfstype_points[@]}"
do
    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="nfs4"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " ${vfstype_point//\\/\\\\} nfs4 defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nodev_remote_filesystems" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002011
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MP-2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_nodev_remote_filesystems
  - no_reboot_needed

- name: Get nfs and nfs4 mount points, that don't have nodev
  command: findmnt --fstab --types nfs,nfs4 -O nonodev -n -P
  register: points_register
  check_mode: false
  changed_when: false
  failed_when: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002011
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MP-2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_nodev_remote_filesystems
  - no_reboot_needed

- name: Add nodev to nfs and nfs4 mount points
  mount:
    path: '{{ item | regex_search(''TARGET="([^"]+)"'',''\1'') | first }}'
    src: '{{ item | regex_search(''SOURCE="([^"]+)"'',''\1'') | first }}'
    fstype: '{{ item | regex_search(''FSTYPE="([^"]+)"'',''\1'') | first }}'
    state: present
    opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},nodev'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (points_register.stdout | length &gt; 0) and '\\x09' not in item
  with_items: '{{ points_register.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002011
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MP-2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_nodev_remote_filesystems
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_nodev_remote_filesystems:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_nodev_remote_filesystems_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems" severity="medium">
                <xccdf-1.2:title>Mount Remote Filesystems with noexec</xccdf-1.2:title>
                <xccdf-1.2:description>Add the <html:code>noexec</html:code> option to the fourth column of <html:code>/etc/fstab</html:code> for the line which controls mounting of
any NFS mounts.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(8)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(10)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002012</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271642r1092593_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>The noexec mount option causes the system not to execute binary files. This option must be used
for mounting any file system not containing approved binary files as they may be incompatible. Executing
files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized
administrative access.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#nfs_mount_defined"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_noexec_remote_filesystems"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

vfstype_points=()
readarray -t vfstype_points &lt; &lt;(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

for vfstype_point in "${vfstype_points[@]}"
do
    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="nfs4"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " ${vfstype_point//\\/\\\\} nfs4 defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_noexec_remote_filesystems" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002012
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(10)
  - NIST-800-53-AC-6(8)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_noexec_remote_filesystems
  - no_reboot_needed

- name: Get nfs and nfs4 mount points, that don't have noexec
  command: findmnt --fstab --types nfs,nfs4 -O nonoexec -n -P
  register: points_register
  check_mode: false
  changed_when: false
  failed_when: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002012
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(10)
  - NIST-800-53-AC-6(8)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_noexec_remote_filesystems
  - no_reboot_needed

- name: Add noexec to nfs and nfs4 mount points
  mount:
    path: '{{ item | regex_search(''TARGET="([^"]+)"'',''\1'') | first }}'
    src: '{{ item | regex_search(''SOURCE="([^"]+)"'',''\1'') | first }}'
    fstype: '{{ item | regex_search(''FSTYPE="([^"]+)"'',''\1'') | first }}'
    state: present
    opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},noexec'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (points_register.stdout | length &gt; 0) and '\\x09' not in item
  with_items: '{{ points_register.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002012
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(10)
  - NIST-800-53-AC-6(8)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_noexec_remote_filesystems
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_noexec_remote_filesystems:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_noexec_remote_filesystems_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems" severity="medium">
                <xccdf-1.2:title>Mount Remote Filesystems with nosuid</xccdf-1.2:title>
                <xccdf-1.2:description>Add the <html:code>nosuid</html:code> option to the fourth column of <html:code>/etc/fstab</html:code> for the line which controls mounting of
any NFS mounts.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002013</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271643r1091641_rule</xccdf-1.2:reference>
                <xccdf-1.2:rationale>NFS mounts should not present suid binaries to users. Only vendor-supplied suid executables
should be installed to their default location on the local filesystem.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="#nfs_mount_defined"/>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="mount_option_nosuid_remote_filesystems"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

vfstype_points=()
readarray -t vfstype_points &lt; &lt;(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

for vfstype_point in "${vfstype_points[@]}"
do
    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="nfs4"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " ${vfstype_point//\\/\\\\} nfs4 defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="mount_option_nosuid_remote_filesystems" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002013
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM6(a)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_nosuid_remote_filesystems
  - no_reboot_needed

- name: Get nfs and nfs4 mount points, that don't have nosuid
  command: findmnt --fstab --types nfs,nfs4 -O nonosuid -n -P
  register: points_register
  check_mode: false
  changed_when: false
  failed_when: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002013
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM6(a)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_nosuid_remote_filesystems
  - no_reboot_needed

- name: Add nosuid to nfs and nfs4 mount points
  mount:
    path: '{{ item | regex_search(''TARGET="([^"]+)"'',''\1'') | first }}'
    src: '{{ item | regex_search(''SOURCE="([^"]+)"'',''\1'') | first }}'
    fstype: '{{ item | regex_search(''FSTYPE="([^"]+)"'',''\1'') | first }}'
    state: present
    opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},nosuid'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (points_register.stdout | length &gt; 0) and '\\x09' not in item
  with_items: '{{ points_register.stdout_lines }}'
  tags:
  - DISA-STIG-OL09-00-002013
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM6(a)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_nosuid_remote_filesystems
  - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-mount_option_nosuid_remote_filesystems:def:1"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-mount_option_nosuid_remote_filesystems_ocil:questionnaire:1"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_servers">
            <xccdf-1.2:title>Configure NFS Servers</xccdf-1.2:title>
            <xccdf-1.2:description>The steps in this section are appropriate for systems which operate as NFS servers.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_all_squash_exports" severity="low">
              <xccdf-1.2:title>Ensure All-Squashing Disabled On All Exports</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>all_squash</html:code> maps all uids and gids to an anonymous user.
This should be disabled by removing any instances of the
<html:code>all_squash</html:code> option from the file <html:code>/etc/exports</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:rationale>The all_squash option maps all client requests to a single anonymous
uid/gid on the NFS server, negating the ability to track file access
by user ID.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_use_kerberos_security_all_exports" severity="medium">
              <xccdf-1.2:title>Use Kerberos Security on All Exports</xccdf-1.2:title>
              <xccdf-1.2:description>Using Kerberos on all exported mounts prevents a malicious client or user from
impersonating a system user. To cryptography authenticate users to the NFS server,
add <html:code>sec=krb5:krb5i:krb5p</html:code> to each export in <html:code>/etc/exports</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When an NFS server is configured to use AUTH_SYS a selected userid and groupid are used to handle
requests from the remote user. The userid and groupid could mistakenly or maliciously be set
incorrectly. The AUTH_GSS method of authentication uses certificates on the server and client
systems to more securely authenticate the remote mount request.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="use_kerberos_security_all_exports" complexity="low" disruption="low" reboot="false" strategy="configure">
nfs_exports=()
readarray -t nfs_exports &lt; &lt;(grep -E "^/.*[[:space:]]+ .*\(.*\)[[:space:]]*$" /etc/exports | awk '{print $2}')

for nfs_export in "${nfs_exports[@]}"
do
    correct_export=""
    if [ "$(grep -c "sec=" &lt;&lt;&lt;"$nfs_export")" -eq 0 ]; then
        correct_export="$(echo $nfs_export|sed  -e 's/).*$/,sec=krb5\:krb5i\:krb5p)/')"
    else
        correct_export="$(echo $nfs_export|sed  -e 's/sec=[^\,\)]*/sec=krb5\:krb5i\:krb5p/')"
    fi
    sed -i "s|$nfs_export|$correct_export|g" /etc/exports
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="use_kerberos_security_all_exports" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Drop any security clause for every export
  replace:
    path: /etc/exports
    regexp: ^(/.*\w+.*\(.*),sec=[^,]*(.*\)\w*$)
    replace: \1\2
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - use_kerberos_security_all_exports

- name: Add kerberos security when no security is defined for an export
  replace:
    path: /etc/exports
    regexp: ^(/.*\w+.*\(.*)(\)\w*$)
    replace: \1,sec=krb5:krb5i:krb5p\2
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - use_kerberos_security_all_exports
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-use_kerberos_security_all_exports:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-use_kerberos_security_all_exports_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ntp">
          <xccdf-1.2:title>Network Time Protocol</xccdf-1.2:title>
          <xccdf-1.2:description>The Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of systems, and that their time is consistent with the
outside world.
<html:br/>
      <html:br/>
If every system on a network reliably reports the same time, then it is much
easier to correlate log messages in case of an attack. In addition, a number of
cryptographic protocols (such as Kerberos) use timestamps to prevent certain
types of attacks. If your network does not have synchronized time, these
protocols may be unreliable or even unusable.
<html:br/>
      <html:br/>
Depending on the specifics of the network, global time accuracy may be just as
important as local synchronization, or not very important at all. If your
network is connected to the Internet, using a public timeserver (or one
provided by your enterprise) provides globally accurate timestamps which may be
essential in investigating or responding to an attack which originated outside
of your network.
<html:br/>
      <html:br/>
A typical network setup involves a small number of internal systems operating
as NTP servers, and the remainder obtaining time information from those
internal servers.
<html:br/>
      <html:br/>
There is a choice between the daemons <html:code>ntpd</html:code> and <html:code>chronyd</html:code>, which
are available from the repositories in the <html:code>ntp</html:code> and <html:code>chrony</html:code>
packages respectively.
<html:br/>
      <html:br/>
The default <html:code>chronyd</html:code> daemon can work well when external time references
are only intermittently accesible, can perform well even when the network is
congested for longer periods of time, can usually synchronize the clock faster
and with better time accuracy, and quickly adapts to sudden changes in the rate
of the clock, for example, due to changes in the temperature of the crystal
oscillator. <html:code>Chronyd</html:code> should be considered for all systems which are
frequently suspended or otherwise intermittently disconnected and reconnected
to a network. Mobile and virtual systems for example.
<html:br/>
      <html:br/>
The <html:code>ntpd</html:code> NTP daemon fully supports NTP protocol version 4 (RFC 5905),
including broadcast, multicast, manycast clients and servers, and the orphan
mode. It also supports extra authentication schemes based on public-key
cryptography (RFC 5906). The NTP daemon (<html:code>ntpd</html:code>) should be considered
for systems which are normally kept permanently on. Systems which are required
to use broadcast or multicast IP, or to perform authentication of packets with
the <html:code>Autokey</html:code> protocol, should consider using <html:code>ntpd</html:code>.
<html:br/>
      <html:br/>
Refer to

    
    <html:a href="https://docs.oracle.com/en/operating-systems/oracle-linux/9/network/network-ConfiguringNetworkTime.html#ol-nettime">https://docs.oracle.com/en/operating-systems/oracle-linux/9/network/network-ConfiguringNetworkTime.html#ol-nettime</html:a>

for more detailed comparison of features of <html:code>chronyd</html:code>
and <html:code>ntpd</html:code> daemon features respectively, and for further guidance how to
choose between the two NTP daemons.
<html:br/>
      <html:br/>
The upstream manual pages at 
    <html:a href="https://chrony-project.org/documentation.html">https://chrony-project.org/documentation.html</html:a> for
<html:code>chronyd</html:code> and 
    <html:a href="http://www.ntp.org">http://www.ntp.org</html:a> for <html:code>ntpd</html:code> provide additional
information on the capabilities and configuration of each of the NTP daemons.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_multiple_time_pools" type="string" interactive="true">
            <xccdf-1.2:title>Vendor Approved Time pools</xccdf-1.2:title>
            <xccdf-1.2:description>The list of vendor-approved pool servers</xccdf-1.2:description>
            <xccdf-1.2:value>0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="fedora">0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="rhel">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="ol">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="suse">0.suse.pool.ntp.org,1.suse.pool.ntp.org,2.suse.pool.ntp.org,3.suse.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="alinux">0.ntp.cloud.aliyuncs.com,1.ntp.aliyun.com,2.ntp1.aliyun.com,3.ntp1.cloud.aliyuncs.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="amazon">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="ubuntu">0.ubuntu.pool.ntp.org,1.ubuntu.pool.ntp.org,2.ubuntu.pool.ntp.org,3.ubuntu.pool.ntp.org</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_multiple_time_servers" type="string" interactive="true">
            <xccdf-1.2:title>Vendor Approved Time Servers</xccdf-1.2:title>
            <xccdf-1.2:description>The list of vendor-approved time servers</xccdf-1.2:description>
            <xccdf-1.2:value>0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="generic">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig">0.us.pool.ntp.mil</xccdf-1.2:value>
            <xccdf-1.2:value selector="fedora">0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="rhel">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="ol">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="suse">0.suse.pool.ntp.org,1.suse.pool.ntp.org,2.suse.pool.ntp.org,3.suse.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="alinux">0.ntp.cloud.aliyuncs.com,1.ntp.aliyun.com,2.ntp1.aliyun.com,3.ntp1.cloud.aliyuncs.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="amazon">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="ubuntu">0.ubuntu.pool.ntp.org,1.ubuntu.pool.ntp.org,2.ubuntu.pool.ntp.org,3.ubuntu.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="almalinux">0.almalinux.pool.ntp.org,1.almalinux.pool.ntp.org,2.almalinux.pool.ntp.org,3.almalinux.pool.ntp.org</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" type="number">
            <xccdf-1.2:title>Maximum NTP or Chrony Poll</xccdf-1.2:title>
            <xccdf-1.2:description>The maximum NTP or Chrony poll interval number in seconds specified as a power of two.</xccdf-1.2:description>
            <xccdf-1.2:value selector="36_hours">17</xccdf-1.2:value>
            <xccdf-1.2:value selector="18_hours">16</xccdf-1.2:value>
            <xccdf-1.2:value>10</xccdf-1.2:value>
            <xccdf-1.2:value selector="system_default">10</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_chrony_installed" severity="medium">
            <xccdf-1.2:title>The Chrony package is installed</xccdf-1.2:title>
            <xccdf-1.2:description>System time should be synchronized between all systems in an environment. This is
typically done by establishing an authoritative time server or set of servers and having all
systems synchronize their clocks to them.
The <html:code>chrony</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install chrony</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004923</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000310</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271501r1091215_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Time synchronization is important to support time sensitive security mechanisms like
Kerberos and also ensures log files have consistent time records across the enterprise,
which aids in forensic investigations.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "chrony" ; then
    yum install -y "chrony"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000310
  - PCI-DSS-Req-10.4
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_chrony_installed

- name: Ensure chrony is installed
  package:
    name: chrony
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000310
  - PCI-DSS-Req-10.4
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_chrony_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_chrony

class install_chrony {
  package { 'chrony':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_chrony_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=chrony
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_chrony_installed">
[[packages]]
name = "chrony"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_chrony_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_chrony_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_chronyd_enabled" severity="medium">
            <xccdf-1.2:title>The Chronyd service is enabled</xccdf-1.2:title>
            <xccdf-1.2:description>chrony is a daemon which implements the Network Time Protocol (NTP) is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a href="https://chrony-project.org/">https://chrony-project.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To enable Chronyd service, you can run:
<html:code># systemctl enable chronyd.service</html:code>
This recommendation only applies if chrony is in use on the system.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004923</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000311</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271502r1091218_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If chrony is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_chronyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q chrony; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'chronyd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'chronyd.service'
fi
"$SYSTEMCTL_EXEC" enable 'chronyd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_chronyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000311
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_chronyd_enabled

- name: The Chronyd service is enabled - Enable service chronyd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: The Chronyd service is enabled - Enable Service chronyd
    ansible.builtin.systemd:
      name: chronyd
      enabled: true
      state: started
      masked: false
    when:
    - '"chrony" in ansible_facts.packages'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000311
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_chronyd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_chronyd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_chronyd

class enable_chronyd {
  service {'chronyd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_chronyd_enabled">
[customizations.services]
enabled = ["chronyd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_chronyd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_chronyd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" severity="medium">
            <xccdf-1.2:title>A remote time server for Chrony is configured</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>Chrony</html:code> is a daemon which implements the Network Time Protocol (NTP). It is designed
to synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on <html:code>chrony</html:code> can be found at

    <html:a href="https://chrony-project.org/">https://chrony-project.org/</html:a>.
<html:code>Chrony</html:code> can be configured to be a client and/or a server.
Add or edit server or pool lines to <html:code>/etc/chrony.conf</html:code> as appropriate:
<html:pre>server &lt;remote-server&gt;</html:pre>
Multiple servers may be configured.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001890</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004926</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004923</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If <html:code>chrony</html:code> is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_specify_remote_server"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q chrony; }; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/chrony.conf"

if ! grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_specify_remote_server" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.2
  - chronyd_specify_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony is already configured with pools or servers
  find:
    path: /etc
    patterns: chrony.conf
    contains: ^[\s]*(?:server|pool)[\s]+[\w]+
  register: chrony_servers
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.2
  - chronyd_specify_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure remote time servers
  lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  - chrony_servers.matched == 0
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.2
  - chronyd_specify_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_specify_remote_server:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_client_only" severity="low">
            <xccdf-1.2:title>Disable chrony daemon from acting as server</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>port</html:code> option in <html:code>/etc/chrony.conf</html:code> can be set to
<html:code>0</html:code> to make chrony daemon to never open any listening port
for server operation and to operate strictly in a client-only mode.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002320</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271697r1091803_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.
Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.
To support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_client_only"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q chrony; }; then

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^port")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^port\\&gt;" "/etc/chrony.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^port\\&gt;.*/$escaped_formatted_output/gi" "/etc/chrony.conf"
else
    if [[ -s "/etc/chrony.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/chrony.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/chrony.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/chrony.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_client_only" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002320
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)
  - chronyd_client_only
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable chrony daemon from acting as server
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/chrony.conf
      create: true
      regexp: (?i)^\s*port\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/chrony.conf
    lineinfile:
      path: /etc/chrony.conf
      create: true
      regexp: (?i)^\s*port\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/chrony.conf
    lineinfile:
      path: /etc/chrony.conf
      create: true
      regexp: (?i)^\s*port\s+
      line: port 0
      state: present
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002320
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)
  - chronyd_client_only
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_client_only:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_client_only_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_configure_pool_and_server" severity="medium">
            <xccdf-1.2:title>Chrony Configure Pool and Server</xccdf-1.2:title>
            <xccdf-1.2:description><html:code>Chrony</html:code> is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on <html:code>chrony</html:code> can be found at

    <html:a href="https://chrony-project.org/">https://chrony-project.org/</html:a>.
<html:code>Chrony</html:code> can be configured to be a client and/or a server.
Add or edit server or pool lines to <html:code>/etc/chrony.conf</html:code> as appropriate:
<html:pre>server &lt;remote-server&gt;</html:pre>
Multiple servers may be configured.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If <html:code>chrony</html:code> is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_configure_pool_and_server"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q chrony; }; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'

var_multiple_time_pools='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_pools" use="legacy"/>'


config_file="/etc/chrony.conf"

# Check and configigure servers in /etc/chrony.conf
IFS="," read -a SERVERS &lt;&lt;&lt; $var_multiple_time_servers
for srv in "${SERVERS[@]}"
do
   NTP_SRV=$(grep -w $srv $config_file)
   if [[ ! "$NTP_SRV" == "server "* ]]
   then
     time_server="server $srv"
     echo $time_server &gt;&gt; "$config_file"
   fi
done

# Check and configure pools in /etc/chrony.conf
IFS="," read -a POOLS &lt;&lt;&lt; $var_multiple_time_pools
for srv in "${POOLS[@]}"
do
   NTP_POOL=$(grep -w $srv $config_file)
   if [[ ! "$NTP_POOL" == "pool "* ]]
   then
     time_server="pool $srv"
     echo $time_server &gt;&gt; "$config_file"
   fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_configure_pool_and_server" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_configure_pool_and_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_multiple_time_pools # promote to variable
  set_fact:
    var_multiple_time_pools: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_pools" use="legacy"/>
  tags:
    - always

- name: Chrony Configure Pool and Server - Add missing / update wrong records for
    remote time servers
  ansible.builtin.lineinfile:
    path: /etc/chrony.conf
    regexp: ^\s*\bserver\b\s*\b{{ item }}\b$
    state: present
    line: server {{ item }}
    create: true
  with_items:
  - '{{ var_multiple_time_servers.split(",") }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_configure_pool_and_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Chrony Configure Pool and Server - Add missing / update wrong records for
    remote time pools
  ansible.builtin.lineinfile:
    path: /etc/chrony.conf
    regexp: ^\s*\bpool\b\s*\b{{ item }}\b$
    state: present
    line: pool {{ item }}
    create: true
  with_items:
  - '{{ var_multiple_time_pools.split(",") }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_configure_pool_and_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_multiple_time_servers:var:1" value-id="xccdf_org.ssgproject.content_value_var_multiple_time_servers"/>
              <xccdf-1.2:check-export export-name="oval:ssg-var_multiple_time_pools:var:1" value-id="xccdf_org.ssgproject.content_value_var_multiple_time_pools"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_configure_pool_and_server:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_configure_pool_and_server_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" severity="low">
            <xccdf-1.2:title>Disable network management of chrony daemon</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>cmdport</html:code> option in <html:code>/etc/chrony.conf</html:code> can be set to
<html:code>0</html:code> to stop chrony daemon from listening on the UDP port 323
for management connections made by chronyc.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002321</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271698r1091806_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Minimizing the exposure of the server functionality of the chrony
daemon diminishes the attack surface.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_no_chronyc_network"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q chrony; }; then

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^cmdport")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^cmdport\\&gt;" "/etc/chrony.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^cmdport\\&gt;.*/$escaped_formatted_output/gi" "/etc/chrony.conf"
else
    if [[ -s "/etc/chrony.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/chrony.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/chrony.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/chrony.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_no_chronyc_network" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002321
  - NIST-800-53-CM-7(1)
  - chronyd_no_chronyc_network
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable network management of chrony daemon
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/chrony.conf
      create: true
      regexp: (?i)^\s*cmdport\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/chrony.conf
    lineinfile:
      path: /etc/chrony.conf
      create: true
      regexp: (?i)^\s*cmdport\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/chrony.conf
    lineinfile:
      path: /etc/chrony.conf
      create: true
      regexp: (?i)^\s*cmdport\s+
      line: cmdport 0
      state: present
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002321
  - NIST-800-53-CM-7(1)
  - chronyd_no_chronyc_network
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_no_chronyc_network:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_no_chronyc_network_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" severity="medium">
            <xccdf-1.2:title>Configure Time Service Maxpoll Interval</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>maxpoll</html:code> should be configured to
<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/> in <html:code>/etc/ntp.conf</html:code> or
<html:code>/etc/chrony.conf</html:code> (or <html:code>/etc/chrony.d/</html:code>) to continuously poll time servers. To configure
<html:code>maxpoll</html:code> in <html:code>/etc/ntp.conf</html:code> or <html:code>/etc/chrony.conf</html:code> (or <html:code>/etc/chrony.d/</html:code>)
add the following after each <html:code>server</html:code>, <html:code>pool</html:code> or <html:code>peer</html:code> entry:
<html:pre>maxpoll <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/>
       </html:pre>
to <html:code>server</html:code> directives. If using chrony, any <html:code>pool</html:code> directives
should be configured too.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001890</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004926</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004923</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000356-GPOS-00144</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000359-GPOS-00146</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002323</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271699r1091809_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.
Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony_or_package_ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_or_ntpd_set_maxpoll"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ( rpm --quiet -q chrony || rpm --quiet -q ntp ); }; then

var_time_service_set_maxpoll='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/>'




pof="/usr/sbin/pidof"


CONFIG_FILES="/etc/ntp.conf"
$pof ntpd || {
    CHRONY_D_PATH=/etc/chrony.d/
    mapfile -t CONFIG_FILES &lt; &lt;(find ${CHRONY_D_PATH}.* -type f -name '*.conf')
    CONFIG_FILES+=(/etc/chrony.conf)
}

# get list of ntp files

for config_file in "${CONFIG_FILES[@]}" ; do
    # Set maxpoll values to var_time_service_set_maxpoll
    sed -i "s/^\(\(server\|pool\|peer\).*maxpoll\) [0-9,-][0-9]*\(.*\)$/\1 $var_time_service_set_maxpoll \3/" "$config_file"
done

for config_file in "${CONFIG_FILES[@]}" ; do
    # Add maxpoll to server, pool or peer entries without maxpoll
    grep "^\(server\|pool\|peer\)" "$config_file" | grep -v maxpoll | while read -r line ; do
        sed -i "s/$line/&amp; maxpoll $var_time_service_set_maxpoll/" "$config_file"
    done
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_or_ntpd_set_maxpoll" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_time_service_set_maxpoll # promote to variable
  set_fact:
    var_time_service_set_maxpoll: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" use="legacy"/>
  tags:
    - always

- name: Configure Time Service Maxpoll Interval - Check That /etc/ntp.conf Exist
  ansible.builtin.stat:
    path: /etc/ntp.conf
  register: ntp_conf_exist_result
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Update the maxpoll Values in /etc/ntp.conf
  ansible.builtin.replace:
    path: /etc/ntp.conf
    regexp: ^(server.*maxpoll)[ ]+[0-9]+(.*)$
    replace: \1 {{ var_time_service_set_maxpoll }}\2
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - ntp_conf_exist_result.stat.exists
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Set the maxpoll Values in /etc/ntp.conf
  ansible.builtin.replace:
    path: /etc/ntp.conf
    regexp: (^server\s+((?!maxpoll).)*)$
    replace: \1 maxpoll {{ var_time_service_set_maxpoll }}\n
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - ntp_conf_exist_result.stat.exists
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Check That /etc/chrony.conf Exist
  ansible.builtin.stat:
    path: /etc/chrony.conf
  register: chrony_conf_exist_result
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Update the maxpoll Values in /etc/chrony.conf
  ansible.builtin.replace:
    path: /etc/chrony.conf
    regexp: ^((?:server|pool|peer).*maxpoll)[ ]+[0-9]+(.*)$
    replace: \1 {{ var_time_service_set_maxpoll }}\2
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - chrony_conf_exist_result.stat.exists
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Set the maxpoll Values in /etc/chrony.conf
  ansible.builtin.replace:
    path: /etc/chrony.conf
    regexp: (^(?:server|pool|peer)\s+((?!maxpoll).)*)$
    replace: \1 maxpoll {{ var_time_service_set_maxpoll }}\n
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - chrony_conf_exist_result.stat.exists
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Get Conf Files from /etc/chrony.d/
  ansible.builtin.find:
    path: /etc/chrony.d/
    patterns: '*.conf'
    file_type: file
  register: chrony_d_conf_files
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Update the maxpoll Values in /etc/chrony.d/
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: ^((?:server|pool|peer).*maxpoll)[ ]+[0-9,-]+(.*)$
    replace: \1 {{ var_time_service_set_maxpoll }}\2
  loop: '{{ chrony_d_conf_files.files }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - chrony_d_conf_files.matched
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Time Service Maxpoll Interval - Set the maxpoll Values in /etc/chrony.d/
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: (^(?:server|pool|peer)\s+((?!maxpoll).)*)$
    replace: \1 maxpoll {{ var_time_service_set_maxpoll }}\n
  loop: '{{ chrony_d_conf_files.files }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - chrony_d_conf_files.matched
  tags:
  - DISA-STIG-OL09-00-002323
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(b)
  - NIST-800-53-CM-6(a)
  - chronyd_or_ntpd_set_maxpoll
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_time_service_set_maxpoll:var:1" value-id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_or_ntpd_set_maxpoll_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" severity="medium">
            <xccdf-1.2:title>Specify Additional Remote NTP Servers</xccdf-1.2:title>
            <xccdf-1.2:description>Depending on specific functional requirements of a concrete
production environment, the Oracle Linux 9 system can be
configured to utilize the services of the <html:code>chronyd</html:code> NTP daemon (the
default), or services of the <html:code>ntpd</html:code> NTP daemon. Refer to

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br/>
Additional NTP servers can be specified for time synchronization. To do so,
perform the following:
<html:ul><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon
(the default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add additional lines of the following form, substituting the IP address or
hostname of a remote NTP server for <html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i>
       </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Specifying additional NTP servers increases the availability of
accurate time data, in the event that one of the specified servers becomes
unavailable. This is typical for a system acting as an NTP server for
other systems.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony_or_package_ntp"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_or_ntpd_specify_multiple_servers"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ( rpm --quiet -q chrony || rpm --quiet -q ntp ); }; then

var_multiple_time_servers='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! [ "$(grep -c '^server' "$config_file")" -gt 1 ] ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_or_ntpd_specify_multiple_servers" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-AU-8(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_or_ntpd_specify_multiple_servers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony configuration file is present
  find:
    path: /etc
    patterns: chrony.conf
  register: chrony_server_config
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  tags:
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-AU-8(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_or_ntpd_specify_multiple_servers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure multiple time servers in chrony config
  lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - chrony_server_config.matched == 1
  tags:
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-AU-8(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_or_ntpd_specify_multiple_servers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Detect if NTP configuration file is present
  find:
    path: /etc
    patterns: ntp.conf
  register: ntp_server_config
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  tags:
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-AU-8(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_or_ntpd_specify_multiple_servers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure multiple time servers in NTP config
  lineinfile:
    path: /etc/chrony.conf
    line: pool {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( "chrony" in ansible_facts.packages or "ntp" in ansible_facts.packages )
  - ntp_server_config.matched == 1
  tags:
  - NIST-800-53-AU-12(1)
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-AU-8(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - chronyd_or_ntpd_specify_multiple_servers
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" severity="medium">
            <xccdf-1.2:title>Ensure that chronyd is running under chrony user account</xccdf-1.2:title>
            <xccdf-1.2:description>chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a href="https://chrony-project.org/">https://chrony-project.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To ensure that chronyd is running under chrony user account,
remove any <html:code>-u ...</html:code> option from <html:code>OPTIONS</html:code> other than <html:code>-u chrony</html:code>,
as chrony is run under its own user by default.
This recommendation only applies if chrony is in use on the system.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If chrony is in use on the system proper configuration is vital to ensuring time synchronization
is working properly.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="chronyd_run_as_chrony_user"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q chrony; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E -e 's/\s*-u\s*\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1\2/' /etc/sysconfig/chronyd
fi

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E -e 's/\s*-u\s*\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u chrony\2/' /etc/sysconfig/chronyd
else
	echo 'OPTIONS="-u chrony"' &gt;&gt; /etc/sysconfig/chronyd
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="chronyd_run_as_chrony_user" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Detect if file /etc/sysconfig/chronyd is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: chronyd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: chronyd_file
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Remove any previous configuration of user used to run chronyd process
  replace:
    path: /etc/sysconfig/chronyd
    regexp: \s*-u\s*\w+\s*
    replace: ' '
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"chrony" in ansible_facts.packages'
  - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_run_as_chrony_user:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_chronyd_server_directive" severity="medium">
            <xccdf-1.2:title>Ensure Chrony is only configured with the server directive</xccdf-1.2:title>
            <xccdf-1.2:description>Check that Chrony only has time sources configured with the <html:code>server</html:code> directive.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule doesn't come with a remediation, the time source needs to be added by the administrator.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001890</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004926</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004923</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000356-GPOS-00144</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000359-GPOS-00146</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002323</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271699r1091809_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Depending on the infrastructure being used the <html:code>pool</html:code> directive may not be supported.
Using the <html:code>server</html:code> directive allows for better control of where the system gets time data from.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_chrony"/>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-chronyd_server_directive:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-chronyd_server_directive_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_chrony_keys" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns /etc/chrony.keys File</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the group owner of <html:code>/etc/chrony.keys</html:code>, run the command: <html:pre>$ sudo chgrp chrony /etc/chrony.keys</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The ownership of the /etc/chrony.keys file by the chrony group is important
because this file hosts chrony cryptographic keys. Protection
of this file is critical for system security. Assigning the ownership to
chrony ensures exclusive control of the chrony cryptography keys.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_etc_chrony_keys" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp chrony /etc/chrony.keys

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_etc_chrony_keys" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupowner_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/chrony.keys
  stat:
    path: /etc/chrony.keys
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupowner_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner chrony on /etc/chrony.keys
  file:
    path: /etc/chrony.keys
    group: chrony
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_etc_chrony_keys:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_etc_chrony_keys_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_etc_chrony_keys" severity="medium">
            <xccdf-1.2:title>Verify User Who Owns /etc/chrony.keys File</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the owner of <html:code>/etc/chrony.keys</html:code>, run the command: <html:pre>$ sudo chown root /etc/chrony.keys </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The ownership of the /etc/chrony.keys file by the chrony user is important
because this file hosts chrony cryptographic keys. Protection
of this file is critical for system security. Assigning the ownership to
chrony ensures exclusive control of the chrony cryptographic keys.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_etc_chrony_keys" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /etc/chrony.keys

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_etc_chrony_keys" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_owner_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/chrony.keys
  stat:
    path: /etc/chrony.keys
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_owner_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/chrony.keys
  file:
    path: /etc/chrony.keys
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_etc_chrony_keys:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_etc_chrony_keys_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_chrony_keys" severity="medium">
            <xccdf-1.2:title>Verify Permissions On /etc/chrony.keys File</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/chrony.keys</html:code>, run the command: <html:pre>$ sudo chmod 0640 /etc/chrony.keys</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Setting correct permissions on the /etc/chrony.keys file is important
because this file hosts chrony cryptographic keys. Protection
of this file is critical for system security. Assigning the correct mode
ensures exclusive control of the chrony cryptographic keys.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_chrony_keys" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xws,o-xwrt /etc/chrony.keys

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_chrony_keys" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/chrony.keys
  stat:
    path: /etc/chrony.keys
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_permissions_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/chrony.keys
  file:
    path: /etc/chrony.keys
    mode: u-xs,g-xws,o-xwrt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_chrony_keys
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_chrony_keys:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_chrony_keys_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_obsolete">
          <xccdf-1.2:title>Obsolete Services</xccdf-1.2:title>
          <xccdf-1.2:description>This section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Oracle Linux 9
by default.
<html:br/>
      <html:br/>
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host

firewall software such as <html:code>iptables</html:code> to restrict access to the

vulnerable service to only those remote hosts which have a known
need to use it.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rsyncd_disabled" severity="medium">
            <xccdf-1.2:title>Ensure rsyncd service is disabled</xccdf-1.2:title>
            <xccdf-1.2:description>
The <html:code>rsyncd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rsyncd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The rsyncd service presents a security risk as it uses unencrypted protocols for
communication.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rsyncd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'rsyncd.service'
fi
"$SYSTEMCTL_EXEC" disable 'rsyncd.service'
"$SYSTEMCTL_EXEC" mask 'rsyncd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files rsyncd.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'rsyncd.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'rsyncd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rsyncd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rsyncd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyncd_disabled

- name: Ensure rsyncd service is disabled - Collect systemd Services Present in the
    System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyncd_disabled

- name: Ensure rsyncd service is disabled - Ensure rsyncd.service is Masked
  ansible.builtin.systemd:
    name: rsyncd.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("rsyncd.service", multiline=True)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyncd_disabled

- name: Unit Socket Exists - rsyncd.socket
  ansible.builtin.command: systemctl -q list-unit-files rsyncd.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyncd_disabled

- name: Ensure rsyncd service is disabled - Disable Socket rsyncd
  ansible.builtin.systemd:
    name: rsyncd.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("rsyncd.socket", multiline=True)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyncd_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rsyncd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rsyncd

class disable_rsyncd {
  service {'rsyncd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rsyncd_disabled">
[customizations.services]
masked = ["rsyncd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_rsyncd_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_r_services">
            <xccdf-1.2:title>Rlogin, Rsh, and Rexec</xccdf-1.2:title>
            <xccdf-1.2:description>The Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rsh-server_removed" severity="high">
              <xccdf-1.2:title>Uninstall rsh-server Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rsh-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase rsh-server</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000105</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271457r1091083_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>rsh-server</html:code> service provides unencrypted remote access service which does not
provide for the confidentiality and integrity of user passwords or the remote session and has very weak
authentication. If a privileged user were to login using this service, the privileged user password
could be compromised. The <html:code>rsh-server</html:code> package provides several obsolete and insecure
network services. Removing it decreases the risk of those services' accidental (or intentional)
activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rsh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove rsh-server
#	   from the system, and may remove any packages
#	   that depend on rsh-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "rsh-server" ; then
yum remove -y "rsh-server"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rsh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure rsh-server is removed
  package:
    name: rsh-server
    state: absent
  tags:
  - DISA-STIG-OL09-00-000105
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_rsh-server_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rsh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rsh-server

class remove_rsh-server {
  package { 'rsh-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rsh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=rsh-server
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_rsh-server_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_rsh-server_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_rsh_removed" severity="unknown">
              <xccdf-1.2:title>Uninstall rsh Package</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>rsh</html:code> package contains the client commands

for the rsh services</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>These legacy clients contain numerous security exposures and have
been replaced with the more secure SSH package. Even if the server is removed,
it is best to ensure the clients are also removed to prevent users from
inadvertently attempting to use these commands and therefore exposing

their credentials. Note that removing the <html:code>rsh</html:code> package removes

the clients for <html:code>rsh</html:code>,<html:code>rcp</html:code>, and <html:code>rlogin</html:code>.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_rsh_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove rsh
#	   from the system, and may remove any packages
#	   that depend on rsh. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "rsh" ; then
yum remove -y "rsh"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_rsh_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure rsh is removed
  package:
    name: rsh
    state: absent
  tags:
  - NIST-800-171-3.1.13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_rsh_removed
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_rsh_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_rsh

class remove_rsh {
  package { 'rsh':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_rsh_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=rsh
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_rsh_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_rsh_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rlogin_disabled" severity="high">
              <xccdf-1.2:title>Disable rlogin Service</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>rlogin</html:code> service, which is available with
the <html:code>rsh-server</html:code> package and runs as a service through xinetd or separately
as a systemd socket, should be disabled.
If using xinetd, set <html:code>disable</html:code> to <html:code>yes</html:code> in <html:code>/etc/xinetd.d/rlogin</html:code>.

The <html:code>rlogin</html:code> socket can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now rlogin.socket</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001436</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The rlogin service uses unencrypted network communications, which
means that data from the login session, including passwords and
all other information transmitted during the session, can be
stolen by eavesdroppers on the network.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rlogin_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'rlogin.service'
fi
"$SYSTEMCTL_EXEC" disable 'rlogin.service'
"$SYSTEMCTL_EXEC" mask 'rlogin.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files rlogin.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'rlogin.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'rlogin.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rlogin.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rlogin_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_rlogin_disabled

- name: Disable rlogin Service - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_rlogin_disabled

- name: Disable rlogin Service - Ensure rlogin.service is Masked
  ansible.builtin.systemd:
    name: rlogin.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("rlogin.service", multiline=True)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_rlogin_disabled

- name: Unit Socket Exists - rlogin.socket
  ansible.builtin.command: systemctl -q list-unit-files rlogin.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_rlogin_disabled

- name: Disable rlogin Service - Disable Socket rlogin
  ansible.builtin.systemd:
    name: rlogin.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("rlogin.socket", multiline=True)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_rlogin_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rlogin_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_rlogin

class disable_rlogin {
  service {'rlogin':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rlogin_disabled">
[customizations.services]
masked = ["rlogin"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_rlogin_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_rlogin_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_host_based_files" severity="high">
              <xccdf-1.2:title>Remove Host-Based Authentication Files</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>shosts.equiv</html:code> file lists remote hosts and users that are trusted by the local
system. To remove these files, run the following command to delete them from any location:
<html:pre>$ sudo rm /[path]/[to]/[file]/shosts.equiv</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002419</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271757r1092604_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The shosts.equiv files are used to configure host-based authentication for the system via SSH.
Host-based authentication is not sufficient for preventing unauthorized access to the system,
as it does not require interactive identification and authentication of a connection request,
or for the use of two-factor authentication.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_host_based_files">
# Identify local mounts
MOUNT_LIST=$(df --local | awk '{ print $6 }')

# Find file on each listed mount point
for cur_mount in ${MOUNT_LIST}
do
	find ${cur_mount} -xdev -type f -name "shosts.equiv" -exec rm -f {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_host_based_files" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Remove Host-Based Authentication Files - Define Excluded (Non-Local) File
    Systems and Paths
  ansible.builtin.set_fact:
    excluded_fstypes:
    - afs
    - ceph
    - cifs
    - smb3
    - smbfs
    - sshfs
    - ncpfs
    - ncp
    - nfs
    - nfs4
    - gfs
    - gfs2
    - glusterfs
    - gpfs
    - pvfs2
    - ocfs2
    - lustre
    - davfs
    - fuse.sshfs
    excluded_paths:
    - dev
    - proc
    - run
    - sys
    search_paths: []
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Find Relevant Root Directories Ignoring
    Pre-Defined Excluded Paths
  ansible.builtin.find:
    paths: /
    file_type: directory
    excludes: '{{ excluded_paths }}'
    hidden: true
    recurse: false
  register: result_relevant_root_dirs
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Include Relevant Root Directories
    in a List of Paths to be Searched
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.path]) }}'
  loop: '{{ result_relevant_root_dirs.files }}'
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Increment Search Paths List with
    Local Partitions Mount Points
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when:
  - item.fstype not in excluded_fstypes
  - item.mount != '/'
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Increment Search Paths List with
    Local NFS File System Targets
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.device is search("localhost:")
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Define Rule Specific Facts
  ansible.builtin.set_fact:
    shosts_equiv_files:
    - /shosts.equiv
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Find All shosts.equiv Files in Local
    File Systems
  ansible.builtin.command:
    cmd: find {{ item }} -xdev -type f -name "shosts.equiv"
  loop: '{{ search_paths }}'
  changed_when: false
  register: result_found_shosts_equiv_files
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Create List of shosts.equiv Files
    Present in Local File Systems
  ansible.builtin.set_fact:
    shosts_equiv_files: '{{ shosts_equiv_files | union(item.stdout_lines) | list }}'
  loop: '{{ result_found_shosts_equiv_files.results }}'
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy

- name: Remove Host-Based Authentication Files - Ensure No shosts.equiv Files Are
    Present in the System
  ansible.builtin.file:
    path: '{{ item }}'
    state: absent
  loop: '{{ shosts_equiv_files }}'
  tags:
  - DISA-STIG-OL09-00-002419
  - high_severity
  - low_complexity
  - low_disruption
  - no_host_based_files
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_host_based_files:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_host_based_files_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" severity="high">
              <xccdf-1.2:title>Remove Rsh Trust Files</xccdf-1.2:title>
              <xccdf-1.2:description>The files <html:code>/etc/hosts.equiv</html:code> and <html:code>~/.rhosts</html:code> (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
<html:pre>$ sudo rm /etc/hosts.equiv</html:pre>
        <html:pre>$ rm ~/.rhosts</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001436</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This action is only meaningful if <html:code>.rhosts</html:code> support is permitted
through PAM. Trust files are convenient, but when used in conjunction with
the R-services, they can allow unauthenticated access to a system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_rsh-server"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_rsh_trust_files"># Remediation is applicable only in certain platforms
if rpm --quiet -q rsh-server; then

find /root -xdev -type f -name ".rhosts" -exec rm -f {} \;
find /home -maxdepth 2 -xdev -type f -name ".rhosts" -exec rm -f {} \;
rm -f /etc/hosts.equiv

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_rsh_trust_files" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy

- name: Detect .rhosts files in users home directories
  find:
    paths:
    - /root
    - /home
    recurse: true
    patterns: .rhosts
    hidden: true
    file_type: file
  check_mode: false
  register: rhosts_locations
  when: '"rsh-server" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy

- name: Remove .rhosts files
  file:
    path: '{{ item }}'
    state: absent
  with_items: '{{ rhosts_locations.files | map(attribute=''path'') | list }}'
  when:
  - '"rsh-server" in ansible_facts.packages'
  - rhosts_locations is success
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy

- name: Remove /etc/hosts.equiv file
  file:
    path: /etc/hosts.equiv
    state: absent
  when: '"rsh-server" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_rsh_trust_files:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_no_user_host_based_files" severity="high">
              <xccdf-1.2:title>Remove User Host-Based Authentication Files</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>~/.shosts</html:code> (in each user's home directory) files
list remote hosts and users that are trusted by the
local system. To remove these files, run the following command
to delete them from any location:
<html:pre>$ sudo find / -name '.shosts' -type f -delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002420</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271758r1091986_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The .shosts files are used to configure host-based authentication for
individual users or the system via SSH. Host-based authentication is not
sufficient for preventing unauthorized access to the system, as it does not
require interactive identification and authentication of a connection request,
or for the use of two-factor authentication.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="no_user_host_based_files">
# Identify local mounts
MOUNT_LIST=$(df --local | awk '{ print $6 }')

# Find file on each listed mount point
for cur_mount in ${MOUNT_LIST}
do
	find ${cur_mount} -xdev -type f -name ".shosts" -exec rm -f {} \;
done
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="no_user_host_based_files" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Remove User Host-Based Authentication Files - Define Excluded (Non-Local)
    File Systems and Paths
  ansible.builtin.set_fact:
    excluded_fstypes:
    - afs
    - ceph
    - cifs
    - smb3
    - smbfs
    - sshfs
    - ncpfs
    - ncp
    - nfs
    - nfs4
    - gfs
    - gfs2
    - glusterfs
    - gpfs
    - pvfs2
    - ocfs2
    - lustre
    - davfs
    - fuse.sshfs
    excluded_paths:
    - dev
    - proc
    - run
    - sys
    search_paths: []
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Find Relevant Root Directories
    Ignoring Pre-Defined Excluded Paths
  ansible.builtin.find:
    paths: /
    file_type: directory
    excludes: '{{ excluded_paths }}'
    hidden: true
    recurse: false
  register: result_relevant_root_dirs
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Include Relevant Root Directories
    in a List of Paths to be Searched
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.path]) }}'
  loop: '{{ result_relevant_root_dirs.files }}'
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Increment Search Paths List
    with Local Partitions Mount Points
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when:
  - item.fstype not in excluded_fstypes
  - item.mount != '/'
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Increment Search Paths List
    with Local NFS File System Targets
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.device is search("localhost:")
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Define Rule Specific Facts
  ansible.builtin.set_fact:
    user_shosts_files:
    - /.shosts
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Find All .shosts Files in Local
    File Systems
  ansible.builtin.command:
    cmd: find {{ item }} -xdev -type f -name ".shosts"
  loop: '{{ search_paths }}'
  changed_when: false
  register: result_found_shosts_files
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Create List of .shosts Files
    Present in Local File Systems
  ansible.builtin.set_fact:
    user_shosts_files: '{{ user_shosts_files | union(item.stdout_lines) | list }}'
  loop: '{{ result_found_shosts_files.results }}'
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy

- name: Remove User Host-Based Authentication Files - Ensure No .shosts Files Are
    Present in the System
  ansible.builtin.file:
    path: '{{ item }}'
    state: absent
  loop: '{{ user_shosts_files }}'
  tags:
  - DISA-STIG-OL09-00-002420
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_user_host_based_files
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-no_user_host_based_files:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-no_user_host_based_files_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_talk">
            <xccdf-1.2:title>Chat/Messaging Services</xccdf-1.2:title>
            <xccdf-1.2:description>The talk software makes it possible for users to send and receive messages
across systems through a terminal session.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_talk-server_removed" severity="medium">
              <xccdf-1.2:title>Uninstall talk-server Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>talk-server</html:code> package can be removed with the following command: <html:pre> $ sudo yum erase talk-server</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The talk software presents a security risk as it uses unencrypted protocols
for communications. Removing the <html:code>talk-server</html:code> package decreases the
risk of the accidental (or intentional) activation of talk services.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_talk-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove talk-server
#	   from the system, and may remove any packages
#	   that depend on talk-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "talk-server" ; then
yum remove -y "talk-server"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_talk-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure talk-server is removed
  package:
    name: talk-server
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_talk-server_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_talk-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_talk-server

class remove_talk-server {
  package { 'talk-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_talk-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=talk-server
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_talk-server_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_talk-server_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_talk_removed" severity="medium">
              <xccdf-1.2:title>Uninstall talk Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>talk</html:code> package contains the client program for the
Internet talk protocol, which allows the user to chat with other users on
different systems. Talk is a communication program which copies lines from one
terminal to the terminal of another user.
The <html:code>talk</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase talk</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The talk software presents a security risk as it uses unencrypted protocols
for communications. Removing the <html:code>talk</html:code> package decreases the
risk of the accidental (or intentional) activation of talk client program.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_talk_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove talk
#	   from the system, and may remove any packages
#	   that depend on talk. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "talk" ; then
yum remove -y "talk"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_talk_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure talk is removed
  package:
    name: talk
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_talk_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_talk_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_talk

class remove_talk {
  package { 'talk':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_talk_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=talk
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_talk_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_talk_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_telnet">
            <xccdf-1.2:title>Telnet</xccdf-1.2:title>
            <xccdf-1.2:description>The telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" severity="high">
              <xccdf-1.2:title>Uninstall telnet-server Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>telnet-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase telnet-server</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000381</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000110</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271458r1091086_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>It is detrimental for operating systems to provide, or install by default,
functionality exceeding requirements or mission objectives. These
unnecessary capabilities are often overlooked and therefore may remain
unsecure. They increase the risk to the platform by providing additional
attack vectors.
<html:br/>
The telnet service provides an unencrypted remote access service which does
not provide for the confidentiality and integrity of user passwords or the
remote session. If a privileged user were to login using this service, the
privileged user password could be compromised.
<html:br/>
Removing the <html:code>telnet-server</html:code> package decreases the risk of the
telnet service's accidental (or intentional) activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_telnet-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove telnet-server
#	   from the system, and may remove any packages
#	   that depend on telnet-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnet-server" ; then
yum remove -y "telnet-server"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_telnet-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnet-server is removed
  package:
    name: telnet-server
    state: absent
  tags:
  - DISA-STIG-OL09-00-000110
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.2
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_telnet-server_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_telnet-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnet-server

class remove_telnet-server {
  package { 'telnet-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_telnet-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=telnet-server
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_telnet-server_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_telnet-server_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_telnet_removed" severity="low">
              <xccdf-1.2:title>Remove telnet Clients</xccdf-1.2:title>
              <xccdf-1.2:description>The telnet client allows users to start connections to other systems via
the telnet protocol.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The <html:code>telnet</html:code> protocol is insecure and unencrypted. The use
of an unencrypted transmission medium could allow an unauthorized user
to steal credentials. The <html:code>ssh</html:code> package provides an
encrypted session and stronger security and is included in Oracle Linux 9.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_telnet_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove telnet
#	   from the system, and may remove any packages
#	   that depend on telnet. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "telnet" ; then
yum remove -y "telnet"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_telnet_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure telnet is removed
  package:
    name: telnet
    state: absent
  tags:
  - NIST-800-171-3.1.13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_telnet_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_telnet_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_telnet

class remove_telnet {
  package { 'telnet':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_telnet_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=telnet
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_telnet_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_telnet_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_telnet_disabled" severity="high">
              <xccdf-1.2:title>Disable telnet Service</xccdf-1.2:title>
              <xccdf-1.2:description>Make sure that the activation of the <html:code>telnet</html:code> service on system boot is disabled.

The <html:code>telnet</html:code> socket can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now telnet.socket</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">If the system relies on <html:code>xinetd</html:code> to manage telnet sessions, ensure the telnet service
is disabled by the following line: <html:code>disable = yes</html:code>. Note that the xinetd file for
telnet is not created automatically, therefore it might have different names.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The telnet protocol uses unencrypted network communication, which means that data from the
login session, including passwords and all other information transmitted during the session,
can be stolen by eavesdroppers on the network. The telnet protocol is also subject to
man-in-the-middle attacks.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_telnet-server_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_telnet_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q telnet-server &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'telnet.service'
fi
"$SYSTEMCTL_EXEC" disable 'telnet.service'
"$SYSTEMCTL_EXEC" mask 'telnet.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files telnet.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'telnet.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'telnet.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'telnet.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_telnet_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_telnet_disabled

- name: Disable telnet Service - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "telnet-server" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_telnet_disabled

- name: Disable telnet Service - Ensure telnet.service is Masked
  ansible.builtin.systemd:
    name: telnet.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "telnet-server" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - service_exists.stdout_lines is search("telnet.service", multiline=True)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_telnet_disabled

- name: Unit Socket Exists - telnet.socket
  ansible.builtin.command: systemctl -q list-unit-files telnet.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "telnet-server" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_telnet_disabled

- name: Disable telnet Service - Disable Socket telnet
  ansible.builtin.systemd:
    name: telnet.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "telnet-server" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - socket_file_exists.stdout_lines is search("telnet.socket", multiline=True)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.4.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-5(1)(c)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_telnet_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_telnet_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_telnet

class disable_telnet {
  service {'telnet':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_telnet_disabled">
[customizations.services]
masked = ["telnet"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_telnet_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_telnet_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_tftp">
            <xccdf-1.2:title>TFTP Server</xccdf-1.2:title>
            <xccdf-1.2:description>TFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" type="string" interactive="true">
              <xccdf-1.2:title>TFTP server secure directory</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the directory which is used by TFTP server as a root directory when running in secure mode.</xccdf-1.2:description>
              <xccdf-1.2:value>/var/lib/tftpboot</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" severity="high">
              <xccdf-1.2:title>Uninstall tftp-server Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>tftp-server</html:code> package can be removed with the following command: <html:pre> $ sudo yum erase tftp-server</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271463r1091101_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Removing the <html:code>tftp-server</html:code> package decreases the risk of the accidental
(or intentional) activation of tftp services.
<html:br/>
        <html:br/>
If TFTP is required for operational support (such as transmission of router
configurations), its use must be documented with the Information Systems
Securty Manager (ISSM), restricted to only authorized personnel, and have
access control rules established.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_tftp-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove tftp-server
#	   from the system, and may remove any packages
#	   that depend on tftp-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "tftp-server" ; then
yum remove -y "tftp-server"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_tftp-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure tftp-server is removed
  package:
    name: tftp-server
    state: absent
  tags:
  - DISA-STIG-OL09-00-000135
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_tftp-server_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_tftp-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_tftp-server

class remove_tftp-server {
  package { 'tftp-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_tftp-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=tftp-server
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_tftp-server_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_tftp-server_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_tftp_removed" severity="low">
              <xccdf-1.2:title>Remove tftp Daemon</xccdf-1.2:title>
              <xccdf-1.2:description>Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol,
typically used to automatically transfer configuration or boot files between systems.
TFTP does not support authentication and can be easily hacked. The package
<html:code>tftp</html:code> is a client program that allows for connections to a <html:code>tftp</html:code> server.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>It is recommended that TFTP be removed, unless there is a specific need
for TFTP (such as a boot server). In that case, use extreme caution when configuring
the services.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_tftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove tftp
#	   from the system, and may remove any packages
#	   that depend on tftp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "tftp" ; then
yum remove -y "tftp"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_tftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure tftp is removed
  package:
    name: tftp
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_tftp_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_tftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_tftp

class remove_tftp {
  package { 'tftp':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_tftp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=tftp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_tftp_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_tftp_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_tftpd_uses_secure_mode" severity="medium">
              <xccdf-1.2:title>Ensure tftp Daemon Uses Secure Mode</xccdf-1.2:title>
              <xccdf-1.2:description>If running the Trivial File Transfer Protocol (TFTP) service is necessary,
it should be configured to change its root directory at startup. To do so,
find the path for the <html:code>tftp</html:code> systemd service:
<html:pre>$ sudo systemctl show tftp | grep FragmentPath=
FragmentPath=/etc/systemd/system/tftp.service</html:pre>

and ensure the <html:code>ExecStart</html:code> line on that file includes the <html:code>-s</html:code> option with a subdirectory:
<html:pre>ExecStart=/usr/sbin/in.tftpd -s <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002426</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271764r1092004_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Using the <html:code>-s</html:code> option causes the TFTP service to only serve files from the
given directory. Serving files from an intentionally-specified directory
reduces the risk of sharing files which should remain private.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_tftp-server"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="tftpd_uses_secure_mode"># Remediation is applicable only in certain platforms
if rpm --quiet -q tftp-server; then

var_tftpd_secure_directory='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" use="legacy"/>'


if grep -q 'server_args' /etc/xinetd.d/tftp; then
    sed -i -E "s;^([[:blank:]]*server_args[[:blank:]]+=[[:blank:]]+.*?)(-s[[:blank:]]+[[:graph:]]+)*(.*)$;\1 -s $var_tftpd_secure_directory \3;" /etc/xinetd.d/tftp
else
    echo "server_args = -s $var_tftpd_secure_directory" &gt;&gt; /etc/xinetd.d/tftp
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="tftpd_uses_secure_mode" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002426
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - tftpd_uses_secure_mode
- name: XCCDF Value var_tftpd_secure_directory # promote to variable
  set_fact:
    var_tftpd_secure_directory: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" use="legacy"/>
  tags:
    - always

- name: Find out if the file exists and contains the line configuring server arguments
  find:
    path: /etc/xinetd.d
    patterns: tftp
    contains: ^[\s]+server_args.*$
  register: tftpd_secure_config_line
  when: '"tftp-server" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002426
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - tftpd_uses_secure_mode

- name: Ensure that TFTP server is configured to start with secure directory
  lineinfile:
    path: /etc/xinetd.d/tftp
    regexp: ^[\s]*(server_args[\s]+=[\s]+.*?)(-s[\s]+[/\.\w]+)*(.*)$
    line: \1 -s {{ var_tftpd_secure_directory }} \3
    state: present
    backrefs: true
  when:
  - '"tftp-server" in ansible_facts.packages'
  - tftpd_secure_config_line is defined and tftpd_secure_config_line.matched &gt; 0
  tags:
  - DISA-STIG-OL09-00-002426
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - tftpd_uses_secure_mode

- name: Insert correct config line to start TFTP server with secure directory
  lineinfile:
    path: /etc/xinetd.d/tftp
    line: server_args = -s {{ var_tftpd_secure_directory }}
    state: present
    create: true
  when:
  - '"tftp-server" in ansible_facts.packages'
  - tftpd_secure_config_line is defined and tftpd_secure_config_line.matched == 0
  tags:
  - DISA-STIG-OL09-00-002426
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - tftpd_uses_secure_mode
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_tftpd_secure_directory:var:1" value-id="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-tftpd_uses_secure_mode:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-tftpd_uses_secure_mode_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_proxy">
          <xccdf-1.2:title>Proxy Server</xccdf-1.2:title>
          <xccdf-1.2:description>A proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the system acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_squid">
            <xccdf-1.2:title>Disable Squid if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>If Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_squid_removed" severity="unknown">
              <xccdf-1.2:title>Uninstall squid Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>squid</html:code> package can be removed with the following command: <html:pre> $ sudo yum erase squid</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If there is no need to make the proxy server software available,
removing it provides a safeguard against its activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_squid_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove squid
#	   from the system, and may remove any packages
#	   that depend on squid. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "squid" ; then
yum remove -y "squid"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_squid_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure squid is removed
  package:
    name: squid
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_squid_removed
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_squid_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_squid

class remove_squid {
  package { 'squid':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_squid_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=squid
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_squid_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_squid_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_squid_disabled" severity="unknown">
              <xccdf-1.2:title>Disable Squid</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>squid</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now squid.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale>Running proxy server software provides a network-based avenue
of attack, and should be removed if not needed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_squid_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_squid_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q squid &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'squid.service'
fi
"$SYSTEMCTL_EXEC" disable 'squid.service'
"$SYSTEMCTL_EXEC" mask 'squid.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files squid.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'squid.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'squid.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'squid.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_squid_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_squid_disabled
  - unknown_severity

- name: Disable Squid - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "squid" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_squid_disabled
  - unknown_severity

- name: Disable Squid - Ensure squid.service is Masked
  ansible.builtin.systemd:
    name: squid.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "squid" in ansible_facts.packages and ("kernel" in ansible_facts.packages or
    "kernel-uek" in ansible_facts.packages) )
  - service_exists.stdout_lines is search("squid.service", multiline=True)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_squid_disabled
  - unknown_severity

- name: Unit Socket Exists - squid.socket
  ansible.builtin.command: systemctl -q list-unit-files squid.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "squid" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_squid_disabled
  - unknown_severity

- name: Disable Squid - Disable Socket squid
  ansible.builtin.systemd:
    name: squid.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "squid" in ansible_facts.packages and ("kernel" in ansible_facts.packages or
    "kernel-uek" in ansible_facts.packages) )
  - socket_file_exists.stdout_lines is search("squid.socket", multiline=True)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_squid_disabled
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_squid_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_squid

class disable_squid {
  service {'squid':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_squid_disabled">
[customizations.services]
masked = ["squid"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_squid_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_squid_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rng">
          <xccdf-1.2:title>Hardware RNG Entropy Gatherer Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>The rngd feeds random data from hardware device to kernel random device.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_rngd_enabled" severity="low">
            <xccdf-1.2:title>Enable the Hardware RNG Entropy Gatherer Service</xccdf-1.2:title>
            <xccdf-1.2:description>The Hardware RNG Entropy Gatherer service should be enabled.

The <html:code>rngd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable rngd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">For Oracle Linux 9 running with kernel FIPS mode enabled this rule is not applicable.
The in-kernel deterministic random bit generator (DRBG) is used in FIPS mode instead.
Consequently, the rngd service can't be started in FIPS mode.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>rngd</html:code> service
feeds random data from hardware device to kernel random device.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#not_runtime_kernel_fips_enabled"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_rngd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( [ "$(sysctl -a | grep -c 'fips_enabled.*1')" -eq 1 ] ); }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rngd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'rngd.service'
fi
"$SYSTEMCTL_EXEC" enable 'rngd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_rngd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_rngd_enabled

- name: Enable the Hardware RNG Entropy Gatherer Service - Enable service rngd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable the Hardware RNG Entropy Gatherer Service - Enable Service rngd
    ansible.builtin.systemd:
      name: rngd
      enabled: true
      state: started
      masked: false
    when:
    - '"rng-tools" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - enable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_rngd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_rngd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_rngd

class enable_rngd {
  service {'rngd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_rngd_enabled">
[customizations.services]
enabled = ["rngd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_rngd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_rngd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_routing">
          <xccdf-1.2:title>Network Routing</xccdf-1.2:title>
          <xccdf-1.2:description>A router is a very desirable target for a
potential adversary because they fulfill a variety of 
infrastructure networking roles such as access to network segments,
gateways to other networks, filtering, etc. Therefore, if one is
required, the system acting as a router should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default routing software is Quagga, and
provided in an RPM package of the same name.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_quagga">
            <xccdf-1.2:title>Disable Quagga if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>If Quagga was installed and activated, but the system
does not need to act as a router, then it should be disabled
and removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_quagga_removed" severity="low">
              <xccdf-1.2:title>Uninstall quagga Package</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>quagga</html:code> package can be removed with the following command: <html:pre> $ sudo yum erase quagga</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271464r1092459_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Routing software is typically used on routers to exchange network topology information
with other routers. If routing software is used when not required, system network
information may be unnecessarily transmitted across the network.
<html:br/>
If there is no need to make the router software available,
removing it provides a safeguard against its activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_quagga_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove quagga
#	   from the system, and may remove any packages
#	   that depend on quagga. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "quagga" ; then
yum remove -y "quagga"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_quagga_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure quagga is removed
  package:
    name: quagga
    state: absent
  tags:
  - DISA-STIG-OL09-00-000140
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_quagga_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_quagga_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_quagga

class remove_quagga {
  package { 'quagga':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_quagga_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=quagga
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_quagga_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_quagga_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_snmp">
          <xccdf-1.2:title>SNMP Server</xccdf-1.2:title>
          <xccdf-1.2:description>The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_snmp_service">
            <xccdf-1.2:title>Disable SNMP Server if Possible</xccdf-1.2:title>
            <xccdf-1.2:description>The system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" severity="unknown">
              <xccdf-1.2:title>Uninstall net-snmp Package</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>net-snmp</html:code> package provides the snmpd service.
The <html:code>net-snmp</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase net-snmp</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.8.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove net-snmp
#	   from the system, and may remove any packages
#	   that depend on net-snmp. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "net-snmp" ; then
yum remove -y "net-snmp"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure net-snmp is removed
  package:
    name: net-snmp
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_net-snmp_removed
  - unknown_severity
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_net-snmp

class remove_net-snmp {
  package { 'net-snmp':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_net-snmp_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=net-snmp
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_net-snmp_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_snmpd_disabled" severity="low">
              <xccdf-1.2:title>Disable snmpd Service</xccdf-1.2:title>
              <xccdf-1.2:description>
The <html:code>snmpd</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now snmpd.service</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1311</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Running SNMP software provides a network-based avenue of attack, and
should be disabled if not needed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_snmpd_and_system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_snmpd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q net-snmp &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'snmpd.service'
fi
"$SYSTEMCTL_EXEC" disable 'snmpd.service'
"$SYSTEMCTL_EXEC" mask 'snmpd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files snmpd.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'snmpd.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'snmpd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'snmpd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_snmpd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled

- name: Disable snmpd Service - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ( "net-snmp" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled

- name: Disable snmpd Service - Ensure snmpd.service is Masked
  ansible.builtin.systemd:
    name: snmpd.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ( "net-snmp" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - service_exists.stdout_lines is search("snmpd.service", multiline=True)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled

- name: Unit Socket Exists - snmpd.socket
  ansible.builtin.command: systemctl -q list-unit-files snmpd.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ( "net-snmp" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled

- name: Disable snmpd Service - Disable Socket snmpd
  ansible.builtin.systemd:
    name: snmpd.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ( "net-snmp" in ansible_facts.packages and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  - socket_file_exists.stdout_lines is search("snmpd.socket", multiline=True)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_snmpd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_snmpd

class disable_snmpd {
  service {'snmpd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_snmpd_disabled">
[customizations.services]
masked = ["snmpd"]
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_snmpd_disabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_snmpd_disabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_snmp_configure_server">
            <xccdf-1.2:title>Configure SNMP Server if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If it is necessary to run the snmpd agent on the system, some best
practices should be followed to minimize the security risk from the
installation. The multiple security models implemented by SNMP cannot be fully
covered here so only the following general configuration advice can be offered:
<html:ul><html:li>use only SNMP version 3 security models and enable the use of authentication and encryption</html:li><html:li>write access to the MIB (Management Information Base) should be allowed only if necessary</html:li><html:li>all access to the MIB should be restricted following a principle of least privilege</html:li><html:li>network access should be limited to the maximum extent possible including restricting to expected network
addresses both in the configuration files and in the system firewall rules</html:li><html:li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
stations</html:li><html:li>ensure that permissions on the <html:code>snmpd.conf</html:code> configuration file (by default, in <html:code>/etc/snmp</html:code>) are 640 or more restrictive</html:li><html:li>ensure that any MIB files' permissions are also 640 or more restrictive</html:li></html:ul>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_snmpd_use_newer_protocol" severity="medium">
              <xccdf-1.2:title>Configure SNMP Service to Use Only SNMPv3 or Newer</xccdf-1.2:title>
              <xccdf-1.2:description>Edit <html:code>/etc/snmp/snmpd.conf</html:code>, removing any references to <html:code>rocommunity</html:code>, <html:code>rwcommunity</html:code>, or <html:code>com2sec</html:code>.
Upon doing that, restart the SNMP service:
<html:pre>$ sudo systemctl restart snmpd</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1311</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Earlier versions of SNMP are considered insecure, as they potentially allow
unauthorized access to detailed system management information.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#package_net-snmp"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-snmpd_use_newer_protocol:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh">
          <xccdf-1.2:title>SSH Server</xccdf-1.2:title>
          <xccdf-1.2:description>The SSH protocol is recommended for remote login and
remote file transfer. SSH provides confidentiality and integrity
for data exchanged between two systems, as well as server
authentication, through the use of public key cryptography. The
implementation included with the system is called OpenSSH, and more
detailed documentation is available from its website,

    <html:a href="https://www.openssh.com">https://www.openssh.com</html:a>.
Its server program is called <html:code>sshd</html:code> and provided by the RPM package
<html:code>openssh-server</html:code>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#system_with_kernel"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_firewalld_sshd_zone" type="string">
            <xccdf-1.2:title>SSH enabled firewalld zone</xccdf-1.2:title>
            <xccdf-1.2:description>Specify firewalld zone to enable SSH service. This value is used only for remediation purposes.</xccdf-1.2:description>
            <xccdf-1.2:value selector="block">block</xccdf-1.2:value>
            <xccdf-1.2:value>public</xccdf-1.2:value>
            <xccdf-1.2:value selector="dmz">dmz</xccdf-1.2:value>
            <xccdf-1.2:value selector="drop">drop</xccdf-1.2:value>
            <xccdf-1.2:value selector="external">external</xccdf-1.2:value>
            <xccdf-1.2:value selector="home">home</xccdf-1.2:value>
            <xccdf-1.2:value selector="internal">internal</xccdf-1.2:value>
            <xccdf-1.2:value selector="public">public</xccdf-1.2:value>
            <xccdf-1.2:value selector="trusted">trusted</xccdf-1.2:value>
            <xccdf-1.2:value selector="work">work</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" type="string">
            <xccdf-1.2:title>SSH Approved ciphers by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the FIPS approved ciphers that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value selector="stig">aes256-ctr,aes192-ctr,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_extended">aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_rhel9">aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value>aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel8">-3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel9">-3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_ubuntu">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_ubuntu2204">aes256-ctr,aes256-gcm@openssh.com,aes192-ctr,aes128-ctr,aes128-gcm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_ol9">aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_approved_macs" type="string">
            <xccdf-1.2:title>SSH Approved MACs by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the FIPS approved MACs (message authentication code) algorithms
	that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value selector="stig">hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_extended">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value>hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_ubuntu">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_ubuntu2204">hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" type="number">
            <xccdf-1.2:title>SSH session Idle time</xccdf-1.2:title>
            <xccdf-1.2:description>Specify duration of allowed idle time.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="120_minutes">7200</xccdf-1.2:value>
            <xccdf-1.2:value selector="14_minutes">840</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="60_minutes">3600</xccdf-1.2:value>
            <xccdf-1.2:value>300</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_listening_port" type="number">
            <xccdf-1.2:title>SSH Server Listening Port</xccdf-1.2:title>
            <xccdf-1.2:description>Specify port the SSH server is listening.</xccdf-1.2:description>
            <xccdf-1.2:value>22</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" type="number">
            <xccdf-1.2:title>SSH Max authentication attempts</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the maximum number of authentication attempts per connection.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
            <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
            <xccdf-1.2:value>4</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_required" type="number">
            <xccdf-1.2:title>SSH is required to be installed</xccdf-1.2:title>
            <xccdf-1.2:description>Specify if the Policy requires SSH to be installed. Used by SSH Rules
to determine if SSH should be uninstalled or configured.<html:br/>
A value of 0 means that the policy doesn't care if OpenSSH server is installed or not. If it is installed, scanner will check for it's configuration, if it's not installed, the check will pass.<html:br/>
A value of 1 indicates that OpenSSH server package is not required by the policy;<html:br/>
A value of 2 indicates that OpenSSH server package is required by the policy.<html:br/>
      </xccdf-1.2:description>
            <xccdf-1.2:value>0</xccdf-1.2:value>
            <xccdf-1.2:value selector="no">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="yes">2</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_strong_macs" type="string">
            <xccdf-1.2:title>SSH Strong MACs by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the FIPS approved MACs (Message Authentication Code) algorithms
	that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value>hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel8">-hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel9">-hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_ubuntu2204">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_ubuntu2404">hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_rhel9">hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig_ol9">hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" type="number">
            <xccdf-1.2:title>SSH Max Sessions Count</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the maximum number of open sessions permitted.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
            <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
            <xccdf-1.2:value>10</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" type="number">
            <xccdf-1.2:title>SSH Max Keep Alive Count</xccdf-1.2:title>
            <xccdf-1.2:description>Specify the maximum number of idle message counts before session is terminated.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
            <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
            <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
            <xccdf-1.2:value>0</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openssh-clients_installed" severity="medium">
            <xccdf-1.2:title>Install OpenSSH client software</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>openssh-clients</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install openssh-clients</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHC_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000260</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271488r1091176_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>This package includes utilities to make encrypted connections and transfer
files securely to SSH servers.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openssh-clients_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "openssh-clients" ; then
    yum install -y "openssh-clients"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openssh-clients_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000260
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openssh-clients_installed

- name: Ensure openssh-clients is installed
  package:
    name: openssh-clients
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000260
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openssh-clients_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openssh-clients_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openssh-clients

class install_openssh-clients {
  package { 'openssh-clients':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openssh-clients_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openssh-clients
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_openssh-clients_installed">
[[packages]]
name = "openssh-clients"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_openssh-clients_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_openssh-clients_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" severity="medium">
            <xccdf-1.2:title>Install the OpenSSH Server Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>openssh-server</html:code> package should be installed.
The <html:code>openssh-server</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install openssh-server</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002420</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002422</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000425-GPOS-00189</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000250</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271482r1091158_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "openssh-server" ; then
    yum install -y "openssh-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000250
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openssh-server_installed

- name: Ensure openssh-server is installed
  package:
    name: openssh-server
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000250
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openssh-server_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_openssh-server

class install_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openssh-server_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=openssh-server
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_openssh-server_installed">
[[packages]]
name = "openssh-server"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_openssh-server_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_openssh-server_removed" severity="medium">
            <xccdf-1.2:title>Remove the OpenSSH Server Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>openssh-server</html:code> package should be removed.
The <html:code>openssh-server</html:code> package can be removed with the following command:
<html:pre>
$ sudo yum erase openssh-server</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:rationale>Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# CAUTION: This remediation script will remove openssh-server
#	   from the system, and may remove any packages
#	   that depend on openssh-server. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "openssh-server" ; then
yum remove -y "openssh-server"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openssh-server_removed

- name: Ensure openssh-server is removed
  package:
    name: openssh-server
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_openssh-server_removed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_openssh-server

class remove_openssh-server {
  package { 'openssh-server':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_openssh-server_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=openssh-server
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_openssh-server_removed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_openssh-server_removed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_sshd_enabled" severity="medium">
            <xccdf-1.2:title>Enable the OpenSSH Service</xccdf-1.2:title>
            <xccdf-1.2:description>The SSH server service, sshd, is commonly needed.

The <html:code>sshd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable sshd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002420</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002422</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-8(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000425-GPOS-00189</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000251</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271483r1091161_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without protection of the transmitted information, confidentiality, and
integrity may be compromised because unprotected communications can be
intercepted and either read or altered.
<html:br/>
       <html:br/>
This checklist item applies to both internal and external networks and all types
of information system components from which information can be transmitted (e.g., servers,
mobile devices, notebook computers, printers, copiers, scanners, etc). Communication paths
outside the physical protection of a controlled boundary are exposed to the possibility
of interception and modification.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_sshd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'sshd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'sshd.service'
fi
"$SYSTEMCTL_EXEC" enable 'sshd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_sshd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000251
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.8
  - NIST-800-171-3.5.4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-8
  - NIST-800-53-SC-8(1)
  - NIST-800-53-SC-8(2)
  - NIST-800-53-SC-8(3)
  - NIST-800-53-SC-8(4)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_sshd_enabled

- name: Enable the OpenSSH Service - Enable service sshd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable the OpenSSH Service - Enable Service sshd
    ansible.builtin.systemd:
      name: sshd
      enabled: true
      state: started
      masked: false
    when:
    - '"openssh-server" in ansible_facts.packages'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000251
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.8
  - NIST-800-171-3.5.4
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-8
  - NIST-800-53-SC-8(1)
  - NIST-800-53-SC-8(2)
  - NIST-800-53-SC-8(3)
  - NIST-800-53-SC-8(4)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_sshd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_sshd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_sshd

class enable_sshd {
  service {'sshd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_sshd_enabled">
[customizations.services]
enabled = ["sshd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_sshd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_sshd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_sshd_disabled" severity="high">
            <xccdf-1.2:title>Disable SSH Server If Possible</xccdf-1.2:title>
            <xccdf-1.2:description>
The SSH server service, sshd, is commonly needed.
However, if it can be disabled, do so.
This is unusual, as SSH is a common method for encrypted and authenticated
remote access.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-3(6)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000185-CTR-000490</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000141-CTR-000315</xccdf-1.2:reference>
            <xccdf-1.2:rationale/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'sshd.service'
fi
"$SYSTEMCTL_EXEC" disable 'sshd.service'
"$SYSTEMCTL_EXEC" mask 'sshd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files sshd.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'sshd.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'sshd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'sshd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-3(6)
  - NIST-800-53-IA-2(4)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_sshd_disabled

- name: Disable SSH Server If Possible - Collect systemd Services Present in the System
  ansible.builtin.command: systemctl -q list-unit-files --type service
  register: service_exists
  changed_when: false
  failed_when: service_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-3(6)
  - NIST-800-53-IA-2(4)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_sshd_disabled

- name: Disable SSH Server If Possible - Ensure sshd.service is Masked
  ansible.builtin.systemd:
    name: sshd.service
    state: stopped
    enabled: false
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - service_exists.stdout_lines is search("sshd.service", multiline=True)
  tags:
  - NIST-800-53-CM-3(6)
  - NIST-800-53-IA-2(4)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_sshd_disabled

- name: Unit Socket Exists - sshd.socket
  ansible.builtin.command: systemctl -q list-unit-files sshd.socket
  register: socket_file_exists
  changed_when: false
  failed_when: socket_file_exists.rc not in [0, 1]
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-3(6)
  - NIST-800-53-IA-2(4)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_sshd_disabled

- name: Disable SSH Server If Possible - Disable Socket sshd
  ansible.builtin.systemd:
    name: sshd.socket
    enabled: false
    state: stopped
    masked: true
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - socket_file_exists.stdout_lines is search("sshd.socket", multiline=True)
  tags:
  - NIST-800-53-CM-3(6)
  - NIST-800-53-IA-2(4)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_sshd_disabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_sshd_disabled" complexity="low" disruption="low" reboot="false" strategy="enable">include disable_sshd

class disable_sshd {
  service {'sshd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_sshd_disabled">
[customizations.services]
masked = ["sshd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_sshd_disabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_sshd_disabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" severity="medium">
            <xccdf-1.2:title>Verify Group Who Owns SSH Server config file</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the group owner of <html:code>/etc/ssh/sshd_config</html:code>, run the command:
<html:pre>$ sudo chgrp root /etc/ssh/sshd_config</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002507</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271776r1092040_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupowner_sshd_config" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chgrp 0 /etc/ssh/sshd_config

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupowner_sshd_config" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002507
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ssh/sshd_config
  stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002507
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner 0 on /etc/ssh/sshd_config
  file:
    path: /etc/ssh/sshd_config
    group: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002507
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupowner_sshd_config:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupowner_sshd_config_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key" severity="medium">
            <xccdf-1.2:title>Verify Group Ownership on SSH Server Private *_key Key Files</xccdf-1.2:title>
            <xccdf-1.2:description>SSH server private keys, files that match the <html:code>/etc/ssh/*_key</html:code> glob, must be
group-owned by <html:code>ssh_keys</html:code> group.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If an unauthorized user obtains the private SSH host key file, the host could be impersonated.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/ssh/ -maxdepth 1 -type f ! -group ssh_keys -regextype posix-extended -regex '^.*_key$' -exec chgrp -L ssh_keys {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*_key$
  command: find -H /etc/ssh/ -maxdepth 1 -type f ! -group ssh_keys -regextype posix-extended
    -regex "^.*_key$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/ssh/ file(s) matching ^.*_key$
  file:
    path: '{{ item }}'
    group: ssh_keys
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupownership_sshd_private_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupownership_sshd_private_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key" severity="medium">
            <xccdf-1.2:title>Verify Group Ownership on SSH Server Public *.pub Key Files</xccdf-1.2:title>
            <xccdf-1.2:description>SSH server public keys, files that match the <html:code>/etc/ssh/*.pub</html:code> glob, must be
group-owned by <html:code>root</html:code> group.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/ssh/ -maxdepth 1 -type f ! -group 0 -regextype posix-extended -regex '^.*\.pub$' -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*\.pub$
  command: find -H /etc/ssh/ -maxdepth 1 -type f ! -group 0 -regextype posix-extended
    -regex "^.*\.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/ssh/ file(s) matching ^.*\.pub$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupownership_sshd_pub_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupownership_sshd_pub_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" severity="medium">
            <xccdf-1.2:title>Verify Owner on SSH Server config file</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the owner of <html:code>/etc/ssh/sshd_config</html:code>, run the command:
<html:pre>$ sudo chown root /etc/ssh/sshd_config </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002508</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271777r1092043_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_owner_sshd_config" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chown 0 /etc/ssh/sshd_config

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_owner_sshd_config" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002508
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ssh/sshd_config
  stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002508
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner 0 on /etc/ssh/sshd_config
  file:
    path: /etc/ssh/sshd_config
    owner: '0'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002508
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_owner_sshd_config:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_owner_sshd_config_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key" severity="medium">
            <xccdf-1.2:title>Verify Ownership on SSH Server Private *_key Key Files</xccdf-1.2:title>
            <xccdf-1.2:description>SSH server private keys, files that match the <html:code>/etc/ssh/*_key</html:code> glob, must be owned
by <html:code>root</html:code> user.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If an unauthorized user obtains the private SSH host key file, the host could be impersonated.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/ssh/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex '^.*_key$' -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*_key$
  command: find -H /etc/ssh/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended
    -regex "^.*_key$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/ssh/ file(s) matching ^.*_key$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_ownership_sshd_private_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_ownership_sshd_private_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key" severity="medium">
            <xccdf-1.2:title>Verify Ownership on SSH Server Public *.pub Key Files</xccdf-1.2:title>
            <xccdf-1.2:description>SSH server public keys, files that match the <html:code>/etc/ssh/*.pub</html:code> glob, must be owned
by <html:code>root</html:code> user.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/ssh/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex '^.*\.pub$' -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*\.pub$
  command: find -H /etc/ssh/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended
    -regex "^.*\.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/ssh/ file(s) matching ^.*\.pub$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_ownership_sshd_pub_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_ownership_sshd_pub_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" severity="medium">
            <xccdf-1.2:title>Verify Permissions on SSH Server config file</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/ssh/sshd_config</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /etc/ssh/sshd_config</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002509</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271778r1092046_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_sshd_config" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xwrs,o-xwrt /etc/ssh/sshd_config

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_sshd_config" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002509
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ssh/sshd_config
  stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002509
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/ssh/sshd_config
  file:
    path: /etc/ssh/sshd_config
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-002509
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_sshd_config:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_sshd_config_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" severity="medium">
            <xccdf-1.2:title>Verify Permissions on SSH Server Private *_key Key Files</xccdf-1.2:title>
            <xccdf-1.2:description>SSH server private keys - files that match the <html:code>/etc/ssh/*_key</html:code> glob, have to have restricted permissions.
If those files are owned by the <html:code>root</html:code> user and the <html:code>root</html:code> group, they have to have the <html:code>0600</html:code> permission or stricter.
If they are owned by the <html:code>root</html:code> user, but by a dedicated group <html:code>ssh_keys</html:code>, they can have the <html:code>0640</html:code> permission or stricter.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002502</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271771r1092025_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If an unauthorized user obtains the private SSH host key file, the host could be
impersonated.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_sshd_private_key"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

for keyfile in /etc/ssh/*_key; do
    test -f "$keyfile" || continue
    if test root:root = "$(stat -c "%U:%G" "$keyfile")"; then
    
	chmod u-xs,g-xwrs,o-xwrt "$keyfile"
    
    elif test root:ssh_keys = "$(stat -c "%U:%G" "$keyfile")"; then
	chmod u-xs,g-xws,o-xwrt "$keyfile"
    else
        echo "Key-like file '$keyfile' is owned by an unexpected user:group combination"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_sshd_private_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002502
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find root:root-owned keys
  ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$"
    -type f -group root -perm /u+xs,g+xwrs,o+xwrt
  register: root_owned_keys
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002502
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for root:root-owned keys
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xwrs,o-xwrt
    state: file
  with_items:
  - '{{ root_owned_keys.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002502
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find root:ssh_keys-owned keys
  ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$"
    -type f -group ssh_keys -perm /u+xs,g+xws,o+xwrt
  register: dedicated_group_owned_keys
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002502
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for root:ssh_keys-owned keys
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
  - '{{ dedicated_group_owned_keys.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002502
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="file_permissions_sshd_private_key">include ssh_private_key_perms

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_sshd_private_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" severity="medium">
            <xccdf-1.2:title>Verify Permissions on SSH Server Public *.pub Key Files</xccdf-1.2:title>
            <xccdf-1.2:description> To properly set the permissions of <html:code>/etc/ssh/*.pub</html:code>, run the command: <html:pre>$ sudo chmod 0644 /etc/ssh/*.pub</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002503</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271772r1092028_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt  -type f -regextype posix-extended -regex '^.*\.pub$' -exec chmod u-xs,g-xws,o-xwt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_sshd_pub_key" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002503
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s)
  command: find -H /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt  -type f -regextype
    posix-extended -regex "^.*\.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002503
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/ssh/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002503
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="file_permissions_sshd_pub_key">include ssh_public_key_perms

class ssh_public_key_perms {
  exec { 'sshd_pub_key':
    command =&gt; "chmod 0644 /etc/ssh/*.pub",
    path    =&gt; '/bin:/usr/bin'
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_sshd_pub_key:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_sshd_50_redhat_exists" severity="medium">
            <xccdf-1.2:title>The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>/etc/ssh/sshd_config.d/50-redhat.conf</html:code> file must exist as it contains important
settings to secure SSH.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">There is no remediation available for this rule since this file needs to have the correct content for the given system.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17 (2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000252</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271484r1092624_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The file must exist to configure SSH correctly.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_sshd_50_redhat_exists:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_iptables_sshd_disabled" severity="unknown">
            <xccdf-1.2:title>Remove SSH Server iptables Firewall exception (Unusual)</xccdf-1.2:title>
            <xccdf-1.2:description>By default, inbound connections to SSH's port are allowed. If the SSH
server is not being used, this exception should be removed from the
firewall configuration.
<html:br/>
       <html:br/>
Edit the files <html:code>/etc/sysconfig/iptables</html:code> and
<html:code>/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use). In each file, locate
and delete the line:
<html:pre>-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT</html:pre>
This is unusual, as SSH is a common method for encrypted and authenticated
remote access.</xccdf-1.2:description>
            <xccdf-1.2:rationale>If inbound SSH connections are not expected, disallowing access to the SSH
port will avoid possible exploitation of the port by an attacker.</xccdf-1.2:rationale>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh_client">
            <xccdf-1.2:title>Configure OpenSSH Client if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>The following configuration changes apply to the SSH client. They can
improve security parameters relwevant to the client user, e.g. increasing
entropy while generating initialization vectors. Note that these changes
influence only the default SSH client configuration. Changes in this group
can be overridden by the client user by modifying files within the
<html:pre>~/.ssh</html:pre> directory or by supplying parameters on the command line.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ssh_client_rekey_limit" severity="medium">
              <xccdf-1.2:title>Configure session renegotiation for SSH client</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>RekeyLimit</html:code> parameter specifies how often
the session key is renegotiated, both in terms of
amount of data that may be transmitted and the time
elapsed. To decrease the default limits, put line
<html:code>RekeyLimit <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" use="legacy"/>
         <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" use="legacy"/>
        </html:code> to file <html:code>/etc/ssh/ssh_config.d/02-rekey-limit.conf</html:code>.
Make sure that there is no other <html:code>RekeyLimit</html:code> configuration preceding
the <html:code>include</html:code> directive in the main config file
<html:code>/etc/ssh/ssh_config</html:code>. Check also other files in
<html:code>/etc/ssh/ssh_config.d</html:code> directory. Files are processed according to
lexicographical order of file names. Make sure that there is no file
processed before <html:code>02-rekey-limit.conf</html:code> containing definition of
<html:code>RekeyLimit</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000424-GPOS-00188</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By decreasing the limit based on the amount of data and enabling
time-based limit, effects of potential attacks against
encryption keys are limited.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="ssh_client_rekey_limit"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_ssh_client_rekey_limit_size='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" use="legacy"/>'
var_ssh_client_rekey_limit_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" use="legacy"/>'


main_config="/etc/ssh/ssh_config"
include_directory="/etc/ssh/ssh_config.d"

if grep -q '^[\s]*RekeyLimit.*$' "$main_config"; then
  sed -i '/^[\s]*RekeyLimit.*/d' "$main_config"
fi

for file in "$include_directory"/*.conf; do
  if grep -q '^[\s]*RekeyLimit.*$' "$file"; then
    sed -i '/^[\s]*RekeyLimit.*/d' "$file"
  fi
done

if [ -e "/etc/ssh/ssh_config.d/02-rekey-limit.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/d" "/etc/ssh/ssh_config.d/02-rekey-limit.conf"
else
    touch "/etc/ssh/ssh_config.d/02-rekey-limit.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/ssh_config.d/02-rekey-limit.conf"

cp "/etc/ssh/ssh_config.d/02-rekey-limit.conf" "/etc/ssh/ssh_config.d/02-rekey-limit.conf.bak"
# Insert at the end of the file
printf '%s\n' "RekeyLimit $var_ssh_client_rekey_limit_size $var_ssh_client_rekey_limit_time" &gt;&gt; "/etc/ssh/ssh_config.d/02-rekey-limit.conf"
# Clean up after ourselves.
rm "/etc/ssh/ssh_config.d/02-rekey-limit.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="ssh_client_rekey_limit" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ssh_client_rekey_limit
- name: XCCDF Value var_ssh_client_rekey_limit_size # promote to variable
  set_fact:
    var_ssh_client_rekey_limit_size: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_ssh_client_rekey_limit_time # promote to variable
  set_fact:
    var_ssh_client_rekey_limit_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" use="legacy"/>
  tags:
    - always

- name: Ensure RekeyLimit is not configured in /etc/ssh/ssh_config
  lineinfile:
    path: /etc/ssh/ssh_config
    create: false
    regexp: ^\s*RekeyLimit.*$
    state: absent
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ssh_client_rekey_limit

- name: Collect all include config files for ssh client which configure RekeyLimit
  find:
    paths: /etc/ssh/ssh_config.d/
    contains: ^[\s]*RekeyLimit.*$
    patterns: '*.config'
  register: ssh_config_include_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ssh_client_rekey_limit

- name: Remove all occurences of RekeyLimit configuration from include config files
    of ssh client
  lineinfile:
    path: '{{ item }}'
    regexp: ^[\s]*RekeyLimit.*$
    state: absent
  loop: '{{ ssh_config_include_files.files }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ssh_client_rekey_limit

- name: Ensure that rekey limit is set to {{ var_ssh_client_rekey_limit_size }} {{
    var_ssh_client_rekey_limit_time }} in /etc/ssh/ssh_config.d/02-rekey-limit.conf
  lineinfile:
    path: /etc/ssh/ssh_config.d/02-rekey-limit.conf
    create: true
    regexp: ^\s*RekeyLimit.*$
    line: RekeyLimit {{ var_ssh_client_rekey_limit_size }} {{ var_ssh_client_rekey_limit_time
      }}
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ssh_client_rekey_limit
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_ssh_client_rekey_limit_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time"/>
                <xccdf-1.2:check-export export-name="oval:ssg-var_ssh_client_rekey_limit_size:var:1" value-id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-ssh_client_rekey_limit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ssh_client_rekey_limit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_ssh_keys_passphrase_protected" severity="medium">
              <xccdf-1.2:title>Verify the SSH Private Key Files Have a Passcode</xccdf-1.2:title>
              <xccdf-1.2:description>When creating SSH key pairs, always use a passcode.
<html:br/>
You can create such keys with the following command:
<html:pre>$ sudo ssh-keygen -n [passphrase]</html:pre>
Oracle Linux 9, for certificate-based authentication, must enforce authorized access to the corresponding private key.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000186</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000067-GPOS-00035</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000905</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271605r1091527_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If an unauthorized user obtains access to a private key without a passcode,
that user would have unauthorized access to any system where the associated
public key has been installed.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-ssh_keys_passphrase_protected_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh_server">
            <xccdf-1.2:title>Configure OpenSSH Server if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description>If the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file <html:code>/etc/ssh/sshd_config</html:code>. The following recommendations can be
applied to this file. See the <html:code>sshd_config(5)</html:code> man page for more
detailed information.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_size" type="string">
              <xccdf-1.2:title>SSH RekeyLimit - size</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the size component of the rekey limit.</xccdf-1.2:description>
              <xccdf-1.2:value selector="sshd_default">default</xccdf-1.2:value>
              <xccdf-1.2:value>512M</xccdf-1.2:value>
              <xccdf-1.2:value selector="512M">512M</xccdf-1.2:value>
              <xccdf-1.2:value selector="1G">1G</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_time" type="string">
              <xccdf-1.2:title>SSH RekeyLimit - size</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the size component of the rekey limit.</xccdf-1.2:description>
              <xccdf-1.2:value selector="sshd_default">none</xccdf-1.2:value>
              <xccdf-1.2:value>1h</xccdf-1.2:value>
              <xccdf-1.2:value selector="1hour">1h</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" type="string">
              <xccdf-1.2:title>SSH Compression Setting</xccdf-1.2:title>
              <xccdf-1.2:description>Specify the compression setting for SSH connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="no">no</xccdf-1.2:value>
              <xccdf-1.2:value selector="delayed">delayed</xccdf-1.2:value>
              <xccdf-1.2:value>no</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" type="string">
              <xccdf-1.2:title>SSH Privilege Separation Setting</xccdf-1.2:title>
              <xccdf-1.2:description>Specify whether and how sshd separates privileges when handling incoming network connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="no">no</xccdf-1.2:value>
              <xccdf-1.2:value selector="yes">yes</xccdf-1.2:value>
              <xccdf-1.2:value selector="sandbox">sandbox</xccdf-1.2:value>
              <xccdf-1.2:value>sandbox</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" type="number" interactive="true">
              <xccdf-1.2:title>SSH LoginGraceTime setting</xccdf-1.2:title>
              <xccdf-1.2:description>Configure parameters for how long the servers stays connected before the user has successfully logged in</xccdf-1.2:description>
              <xccdf-1.2:value>60</xccdf-1.2:value>
              <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" type="string" interactive="true">
              <xccdf-1.2:title>SSH MaxStartups setting</xccdf-1.2:title>
              <xccdf-1.2:description>Configure parameters for maximum concurrent unauthenticated connections to the SSH daemon.</xccdf-1.2:description>
              <xccdf-1.2:value>10:30:100</xccdf-1.2:value>
              <xccdf-1.2:value selector="10:30:60">10:30:60</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy" severity="medium">
              <xccdf-1.2:title>SSHD Must Include System Crypto Policy Config File</xccdf-1.2:title>
              <xccdf-1.2:description>SSHD should follow the system cryptographic policy.
In order to accomplish this the SSHD configuration should include the configuration file provided by the system crypto policy.
The following line should be present in <html:code>/etc/ssh/sshd_config</html:code> or in a file included by this file (a file within the <html:code>/etc/ssh/sshd_config.d</html:code> directory):
<html:pre>Include /etc/crypto-policies/back-ends/opensshserver.config</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">There is no automated remediation because recommended action could severely disrupt the system and might not be efficient in fixing the problem.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17 (2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000252</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271484r1092624_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without cryptographic integrity protections, information can be altered by unauthorized users without detection.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_include_crypto_policy:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0" severity="medium">
              <xccdf-1.2:title>Set SSH Client Alive Count Max to zero</xccdf-1.2:title>
              <xccdf-1.2:description>The SSH server sends at most <html:code>ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code>ClientAliveInterval</html:code> configures timeout after
each <html:code>ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered unresponsive
and terminated.

To ensure the SSH timeout occurs precisely when the
<html:code>ClientAliveInterval</html:code> is set, set the <html:code>ClientAliveCountMax</html:code> to
value of <html:code>0</html:code> in


<html:code>/etc/ssh/sshd_config</html:code>:</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000126-GPOS-00066</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This ensures a user login will be terminated as soon as the <html:code>ClientAliveInterval</html:code>
is reached.</xccdf-1.2:rationale>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_keepalive_0" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "ClientAliveCountMax 0" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_keepalive_0" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive_0

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive_0

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*ClientAliveCountMax.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive_0

- name: Set SSH Client Alive Count Max to zero
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
      line: ClientAliveCountMax 0
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive_0
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_keepalive_0:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" severity="medium">
              <xccdf-1.2:title>Set SSH Client Alive Count Max</xccdf-1.2:title>
              <xccdf-1.2:description>The SSH server sends at most <html:code>ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code>ClientAliveInterval</html:code> configures timeout after
each <html:code>ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered unresponsive
and terminated.
For SSH earlier than v8.2, a <html:code>ClientAliveCountMax</html:code> value of <html:code>0</html:code>
causes a timeout precisely when the <html:code>ClientAliveInterval</html:code> is set.
Starting with v8.2, a value of <html:code>0</html:code> disables the timeout functionality
completely. If the option is set to a number greater than <html:code>0</html:code>, then
the session will be disconnected after
<html:code>ClientAliveInterval * ClientAliveCountMax</html:code> seconds without receiving
a keep alive message.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002346</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271709r1091839_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This ensures a user login will be terminated as soon as the <html:code>ClientAliveInterval</html:code>
is reached.</xccdf-1.2:rationale>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_keepalive" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_sshd_set_keepalive='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_keepalive" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002346
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive
- name: XCCDF Value var_sshd_set_keepalive # promote to variable
  set_fact:
    var_sshd_set_keepalive: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002346
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*ClientAliveCountMax.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002346
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive

- name: Set SSH Client Alive Count Max
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
      line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002346
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_keepalive:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" severity="medium">
              <xccdf-1.2:title>Set SSH Client Alive Interval</xccdf-1.2:title>
              <xccdf-1.2:description>SSH allows administrators to set a network responsiveness timeout interval.
After this interval has passed, the unresponsive client will be automatically logged out.
<html:br/>
        <html:br/>
To set this timeout interval, edit the following line in <html:code>/etc/ssh/sshd_config</html:code> as
follows:
<html:pre>ClientAliveInterval <html:b><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/></html:b>
        </html:pre>
        <html:br/>
        <html:br/>
The timeout <html:b>interval</html:b> is given in seconds. For example, have a timeout
of 10 minutes, set <html:b>interval</html:b> to 600.
<html:br/>
        <html:br/>
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made in <html:code>/etc/ssh/sshd_config</html:code>. Keep in mind that
some processes may stop SSH from correctly detecting that the user is idle.</xccdf-1.2:description>
              <xccdf-1.2:warning category="dependency">SSH disconnecting unresponsive clients will not have desired effect without also
configuring ClientAliveCountMax in the SSH service configuration.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">Following conditions may prevent the SSH session to time out:
<html:ul><html:li>Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.</html:li><html:li>Any <html:code>scp</html:code> or <html:code>sftp</html:code> activity by the same user to the host resets the timeout.</html:li></html:ul>
       </xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002891</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000126-GPOS-00066</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000395-GPOS-00175</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.5.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002347</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271710r1092596_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Terminating an idle ssh session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management session
enabled on the console or console port that has been let unattended.</xccdf-1.2:rationale>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_idle_timeout" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

sshd_idle_timeout_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*ClientAliveInterval/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_idle_timeout" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002347
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout
- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002347
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*ClientAliveInterval.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002347
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout

- name: Set SSH Client Alive Interval
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveInterval\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveInterval\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*ClientAliveInterval\s+
      line: ClientAliveInterval {{ sshd_idle_timeout_value }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002347
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_idle_timeout:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_disable_host_auth" severity="medium">
              <xccdf-1.2:title>Disable Host-Based Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>SSH's cryptographic host-based authentication is
more secure than <html:code>.rhosts</html:code> authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
<html:br/>
The default SSH configuration disables host-based authentication. The appropriate
configuration is used if no value is set for <html:code>HostbasedAuthentication</html:code>.
<html:br/>
To explicitly disable host-based authentication, add or correct the
following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>HostbasedAuthentication no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002357</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271719r1091869_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="disable_host_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*HostbasedAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "HostbasedAuthentication no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="disable_host_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002357
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002357
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*HostbasedAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002357
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable Host-Based Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*HostbasedAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*HostbasedAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*HostbasedAuthentication\s+
      line: HostbasedAuthentication no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002357
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-disable_host_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-disable_host_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled" severity="medium">
              <xccdf-1.2:title>Enable SSH Server firewalld Firewall Exception</xccdf-1.2:title>
              <xccdf-1.2:description>If the SSH server is in use, inbound connections to SSH's port should be allowed to permit
remote access through SSH. In more restrictive firewalld settings, the SSH port should be
added to the proper firewalld zone in order to allow SSH remote access.
<html:br/>
        <html:br/>

To configure <html:code>firewalld</html:code> to allow <html:code>ssh</html:code> access, run the following command(s):
<html:pre>firewall-cmd --permanent --add-service=ssh</html:pre>
Then run the following command to load the newly created rule(s):
<html:pre>firewall-cmd --reload</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">The remediation for this rule uses <html:code>firewall-cmd</html:code> and <html:code>nmcli</html:code> tools.
Therefore, it will only be executed if <html:code>firewalld</html:code> and <html:code>NetworkManager</html:code>
services are running. Otherwise, the remediation will be aborted and a informative message
will be shown in the remediation report.
These respective services will not be started in order to preserve any intentional change
in network components related to firewall and network interfaces.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">This rule also checks if the SSH port was modified by the administrator in the firewalld
services definitions and is reflecting the expected port number. Although this is checked,
fixing the custom ssh.xml file placed by the administrator at /etc/firewalld/services it
is not in the scope of the remediation since there is no reliable way to manually change
the respective file. If the default SSH port is modified, it is on the administrator
responsibility to ensure the firewalld customizations in the service port level are
properly configured.</xccdf-1.2:warning>
              <xccdf-1.2:warning category="management">Oracle Linux 9 prefers and recommends to use NetworkManager keyfiles instead of the
<html:code>ifcfg</html:code> files stored in <html:code>/etc/sysconfig/network-scripts</html:code>. Therefore, if the
system was upgraded from a previous release, make sure the NIC configuration files are
properly migrated from <html:code>ifcfg</html:code> format to NetworkManager keyfiles. Otherwise, this
rule won't be able to check the configuration. The migration can be accomplished by
<html:code>nmcli connection migrate</html:code> command.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000382</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1416</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271471r1091125_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If inbound SSH connections are expected, adding the SSH port to the proper firewalld zone
will allow remote access through the SSH port.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="firewalld_sshd_port_enabled" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "firewalld" ; then
    yum install -y "firewalld"
fi
if ! rpm -q --quiet "NetworkManager" ; then
    yum install -y "NetworkManager"
fi
firewalld_sshd_zone='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_firewalld_sshd_zone" use="legacy"/>'


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
    # By default, NetworkManager interfaces are created only once
    # container image is booted so we do not have information about
    # what interfaces will be created during container build time.
    # Therefore, we will rely on NetworkManager to automatically assign
    # interfaces to the default firewalld zone. For more details see:
    # https://firewalld.org/documentation/man-pages/firewalld.zone.html
    # https://firewalld.org/documentation/zone/connections-interfaces-and-sources.html
    # That also means this remediation only works if zone defined in
    # the firewalld_sshd_zone variable equals to the default zone of firewalld.
    default_zone=$(firewall-offline-cmd --get-default-zone)
    if [ "$firewalld_sshd_zone" != "$default_zone" ]; then
        echo "Firewalld default zone ($default_zone) and pre-set zone for sshd ($firewalld_sshd_zone) differ. Remediation aborted!" &gt;&amp;2
        exit 1
    fi

    # Make sure default zone is set in all existing NetworkManager keyfiles.
    while IFS= read -r -d '' file; do
        sed "s|^\s*zone=.*$|zone=$firewalld_sshd_zone|g" "$file"
    done &lt; &lt;(find /etc/NetworkManager/system-connections -maxdepth 1 -name "*.nmconnection" -print0)

    firewall-offline-cmd --zone="$firewalld_sshd_zone" --add-service=ssh
else
    if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)"; then
        # TODO: NM (nmcli) now has --offline mode support, and it could operate without NM service.
        # See: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1183
        # The feature is not quite straighforward (and probably incomplete), though.
        echo "Not applicable in offline mode. Remediation aborted!"
    else
        if systemctl is-active NetworkManager &amp;&amp; systemctl is-active firewalld; then
            # First make sure the SSH service is enabled in run-time for the proper zone.
            # This is to avoid connection issues when new interfaces are addeded to this zone.
            firewall-cmd --zone="$firewalld_sshd_zone" --add-service=ssh

            # This will collect all NetworkManager connections names
            readarray -t nm_connections &lt; &lt;(nmcli -g UUID,TYPE con | grep -v loopback | awk -F ':' '{ print $1 }')
            # If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.
            # This will not change connections which are already assigned to any firewalld zone.
            for connection in "${nm_connections[@]}"; do
                current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')
                if [ $current_zone = "--" ]; then
                    nmcli connection modify "$connection" connection.zone $firewalld_sshd_zone
                fi
            done
            systemctl restart NetworkManager

            # Active zones are zones with at least one interface assigned to it.
            # It is possible that traffic is coming by any active interface and consequently any
            # active zone. So, this make sure all active zones are permanently allowing SSH service.
            readarray -t firewalld_active_zones &lt; &lt;(firewall-cmd --get-active-zones | grep -v "^ " | cut -d " " -f 1)
            for zone in "${firewalld_active_zones[@]}"; do
                firewall-cmd --permanent --zone="$zone" --add-service=ssh
            done
            firewall-cmd --reload
        else
            echo "The firewalld or NetworkManager service is not active. Remediation aborted!"
        fi
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="firewalld_sshd_port_enabled" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000222
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value firewalld_sshd_zone # promote to variable
  set_fact:
    firewalld_sshd_zone: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_firewalld_sshd_zone" use="legacy"/>
  tags:
    - always

- name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld and NetworkManager
    packages are installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  - NetworkManager
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000222
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Collect facts about system
    services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000222
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Remediation is applicable
    if firewalld and NetworkManager services are running
  block:

  - name: Enable SSH Server firewalld Firewall Exception - Collect NetworkManager
      connections names
    ansible.builtin.shell:
      cmd: nmcli -g UUID,TYPE con | grep -v loopback | awk -F ':' '{ print $1 }'
    register: result_nmcli_cmd_connections_names
    changed_when: false

  - name: Enable SSH Server firewalld Firewall Exception - Collect NetworkManager
      connections zones
    ansible.builtin.shell:
      cmd: nmcli -f connection.zone connection show {{ item | trim }} | awk '{ print
        $2}'
    register: result_nmcli_cmd_connections_zones
    changed_when: false
    with_items:
    - '{{ result_nmcli_cmd_connections_names.stdout_lines }}'

  - name: Enable SSH Server firewalld Firewall Exception - Ensure NetworkManager connections
      are assigned to a firewalld zone
    ansible.builtin.command:
      cmd: nmcli connection modify {{ item.0 }} connection.zone {{ firewalld_sshd_zone
        }}
    register: result_nmcli_cmd_connections_assignment
    with_together:
    - '{{ result_nmcli_cmd_connections_names.stdout_lines }}'
    - '{{ result_nmcli_cmd_connections_zones.results }}'
    when:
    - item.1.stdout == '--'

  - name: Enable SSH Server firewalld Firewall Exception - Ensure NetworkManager connections
      changes are applied
    ansible.builtin.service:
      name: NetworkManager
      state: restarted
    when:
    - result_nmcli_cmd_connections_assignment is changed

  - name: Enable SSH Server firewalld Firewall Exception - Collect firewalld active
      zones
    ansible.builtin.shell:
      cmd: firewall-cmd --get-active-zones | grep -v "^ " | cut -d " " -f 1
    register: result_firewall_cmd_zones_names
    changed_when: false

  - name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld zones
      allow SSH
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone={{ item }} --add-service=ssh
    register: result_nmcli_cmd_connections_assignment
    changed_when:
    - '''ALREADY_ENABLED'' not in result_nmcli_cmd_connections_assignment.stderr'
    with_items:
    - '{{ result_firewall_cmd_zones_names.stdout_lines }}'

  - name: Enable SSH Server firewalld Firewall Exception - Ensure firewalld changes
      are applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_nmcli_cmd_connections_assignment is changed
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_facts.services['firewalld.service'].state == 'running'
  - ansible_facts.services['NetworkManager.service'].state == 'running'
  tags:
  - DISA-STIG-OL09-00-000222
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable SSH Server firewalld Firewall Exception - Informative message based
    on services states
  ansible.builtin.assert:
    that:
    - ansible_facts.services['firewalld.service'].state == 'running'
    - ansible_facts.services['NetworkManager.service'].state == 'running'
    fail_msg:
    - firewalld and NetworkManager services are not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld and NetworkManager
      services running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Enable SSH Server firewalld Firewall Exception remediation successfully executed
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000222
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - firewalld_sshd_port_enabled
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_listening_port:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_listening_port"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-firewalld_sshd_port_enabled:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-firewalld_sshd_port_enabled_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" severity="high">
              <xccdf-1.2:title>Allow Only SSH Protocol 2</xccdf-1.2:title>
              <xccdf-1.2:description>Only SSH protocol version 2 connections should be
permitted. The default setting in
<html:code>/etc/ssh/sshd_config</html:code> is correct, and can be
verified by ensuring that the following
line appears:
<html:pre>Protocol 2</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">As of <html:code>openssh-server</html:code> version <html:code>7.4</html:code> and above, the only protocol
supported is version 2, and line <html:pre>Protocol 2</html:pre> in
<html:code>/etc/ssh/sshd_config</html:code> is not necessary.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000197</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1449</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1506</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH protocol version 1 is an insecure implementation of the SSH protocol and
has many well-known vulnerability exploits. Exploits of the SSH daemon could provide
immediate root access to the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_allow_only_protocol2" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*Protocol/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*Protocol\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "Protocol 2" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_allow_only_protocol2" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.13
  - NIST-800-171-3.5.4
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_allow_only_protocol2

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.13
  - NIST-800-171-3.5.4
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_allow_only_protocol2

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*Protocol.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.13
  - NIST-800-171-3.5.4
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_allow_only_protocol2

- name: Allow Only SSH Protocol 2
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Protocol\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Protocol\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Protocol\s+
      line: Protocol 2
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.13
  - NIST-800-171-3.5.4
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_allow_only_protocol2
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_allow_only_protocol2:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_compression" severity="medium">
              <xccdf-1.2:title>Disable Compression Or Set Compression to delayed</xccdf-1.2:title>
              <xccdf-1.2:description>Compression is useful for slow network connections over long
distances but can cause performance issues on local LANs. If use of compression
is required, it should be enabled only after a user has authenticated; otherwise,
it should be disabled. To disable compression or delay compression until after
a user has successfully authenticated, add or correct the following line in the
<html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>Compression <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002355</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271717r1091863_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If compression is allowed in an SSH connection prior to authentication,
vulnerabilities in the compression software could result in compromise of the
system from an unauthenticated connection, potentially with root privileges.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_compression" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_sshd_disable_compression='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*Compression/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*Compression\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "Compression $var_sshd_disable_compression" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_compression" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002355
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_compression
- name: XCCDF Value var_sshd_disable_compression # promote to variable
  set_fact:
    var_sshd_disable_compression: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002355
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_compression

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*Compression.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002355
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_compression

- name: Disable Compression Or Set Compression to delayed
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Compression\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Compression\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Compression\s+
      line: Compression {{ var_sshd_disable_compression }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002355
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_compression
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_disable_compression:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_compression:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" severity="high">
              <xccdf-1.2:title>Disable SSH Access via Empty Passwords</xccdf-1.2:title>
              <xccdf-1.2:description>Disallow SSH login with empty passwords.
The default SSH configuration disables logins with empty passwords. The appropriate
configuration is used if no value is set for <html:code>PermitEmptyPasswords</html:code>.
<html:br/>
To explicitly disallow SSH login from accounts with empty passwords,
add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:br/>
        <html:pre>PermitEmptyPasswords no</html:pre>
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002343</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271706r1091830_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Configuring this setting for the SSH daemon provides additional assurance
that remote login via SSH will require a password, even in the event of
misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_empty_passwords" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PermitEmptyPasswords/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitEmptyPasswords no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_empty_passwords" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002343
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002343
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PermitEmptyPasswords.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002343
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Disable SSH Access via Empty Passwords
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
      line: PermitEmptyPasswords no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002343
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_empty_passwords:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" severity="medium">
              <xccdf-1.2:title>Disable GSSAPI Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like GSSAPI.
<html:br/>
The default SSH configuration disallows authentications based on GSSAPI. The appropriate
configuration is used if no value is set for <html:code>GSSAPIAuthentication</html:code>.
<html:br/>
To explicitly disable GSSAPI authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>GSSAPIAuthentication no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000364-GPOS-00151</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002341</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271704r1091824_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>GSSAPI authentication is used to provide additional authentication mechanisms to
applications. Allowing GSSAPI authentication through SSH exposes the system's
GSSAPI to remote hosts, increasing the attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "GSSAPIAuthentication no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002341
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_gssapi_auth

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002341
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_gssapi_auth

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*GSSAPIAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002341
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_gssapi_auth

- name: Disable GSSAPI Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
      line: GSSAPIAuthentication no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002341
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_gssapi_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_gssapi_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" severity="medium">
              <xccdf-1.2:title>Disable Kerberos Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms like Kerberos.
<html:br/>
The default SSH configuration disallows authentication validation through Kerberos.
The appropriate configuration is used if no value is set for <html:code>KerberosAuthentication</html:code>.
<html:br/>
To explicitly disable Kerberos authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>KerberosAuthentication no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001813</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTP_ITC_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000364-GPOS-00151</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002356</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271718r1091866_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Kerberos authentication for SSH is often implemented using GSSAPI. If Kerberos
is enabled through SSH, the SSH daemon provides a means of access to the
system's Kerberos implementation.
Configuring these settings for the SSH daemon provides additional assurance that remote logon via SSH will not use unused methods of authentication, even in the event of misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_kerb_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*KerberosAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*KerberosAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "KerberosAuthentication no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_kerb_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002356
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_kerb_auth

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002356
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_kerb_auth

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*KerberosAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002356
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_kerb_auth

- name: Disable Kerberos Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*KerberosAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*KerberosAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*KerberosAuthentication\s+
      line: KerberosAuthentication no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002356
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_kerb_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_kerb_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_pubkey_auth" severity="medium">
              <xccdf-1.2:title>Disable PubkeyAuthentication Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Unless needed, SSH should not permit extraneous or unnecessary
authentication mechanisms. To disable PubkeyAuthentication authentication, add or
correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>PubkeyAuthentication no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale>PubkeyAuthentication authentication is used to provide additional authentication mechanisms to
applications. Allowing PubkeyAuthentication authentication through SSH allows users to
generate their own authentication tokens, increasing the attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PubkeyAuthentication no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_pubkey_auth

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_pubkey_auth

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PubkeyAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_pubkey_auth

- name: Disable PubkeyAuthentication Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PubkeyAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PubkeyAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PubkeyAuthentication\s+
      line: PubkeyAuthentication no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_pubkey_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_pubkey_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_pubkey_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" severity="medium">
              <xccdf-1.2:title>Disable SSH Support for .rhosts Files</xccdf-1.2:title>
              <xccdf-1.2:description>SSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via <html:code>.rhosts</html:code> files.
<html:br/>
The default SSH configuration disables support for <html:code>.rhosts</html:code>. The appropriate
configuration is used if no value is set for <html:code>IgnoreRhosts</html:code>.
<html:br/>
To explicitly disable support for .rhosts files, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>IgnoreRhosts yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002348</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271711r1091845_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_rhosts" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*IgnoreRhosts/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "IgnoreRhosts yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_rhosts" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002348
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002348
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*IgnoreRhosts.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002348
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Disable SSH Support for .rhosts Files
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*IgnoreRhosts\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*IgnoreRhosts\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*IgnoreRhosts\s+
      line: IgnoreRhosts yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002348
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_rhosts:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" severity="medium">
              <xccdf-1.2:title>Disable SSH Support for Rhosts RSA Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>SSH can allow authentication through the obsolete rsh
command through the use of the authenticating user's SSH keys. This should be disabled.
<html:br/>
        <html:br/>
To ensure this behavior is disabled, add or correct the
following line in <html:code>/etc/ssh/sshd_config</html:code>:
<html:pre>RhostsRSAAuthentication no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">As of <html:code>openssh-server</html:code> version <html:code>7.4</html:code> and above,
the <html:code>RhostsRSAAuthentication</html:code> option has been deprecated, and the line
<html:pre>RhostsRSAAuthentication no</html:pre> in <html:code>/etc/ssh/sshd_config</html:code> is not
necessary.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Configuring this setting for the SSH daemon provides additional
assurance that remote login via SSH will require a password, even
in the event of misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_rhosts_rsa" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*RhostsRSAAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*RhostsRSAAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "RhostsRSAAuthentication no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_rhosts_rsa" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts_rsa

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts_rsa

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*RhostsRSAAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts_rsa

- name: Disable SSH Support for Rhosts RSA Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*RhostsRSAAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*RhostsRSAAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*RhostsRSAAuthentication\s+
      line: RhostsRSAAuthentication no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts_rsa
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_rhosts_rsa:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" severity="medium">
              <xccdf-1.2:title>Disable SSH Root Login</xccdf-1.2:title>
              <xccdf-1.2:description>The root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>PermitRootLogin no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004045</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000148-CTR-000335</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000190-CTR-000500</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002345</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271708r1092594_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Even though the communications channel may be encrypted, an additional layer of
security is gained by extending the policy of not logging directly on as root.
In addition, logging in with a user-specific account provides individual
accountability of actions performed on the system and also helps to minimize
direct attack attempts on root's password.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_root_login" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitRootLogin no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_root_login" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002345
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002345
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PermitRootLogin.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002345
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Disable SSH Root Login
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitRootLogin\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitRootLogin\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitRootLogin\s+
      line: PermitRootLogin no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002345
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_root_login:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_root_password_login" severity="medium">
              <xccdf-1.2:title>Disable SSH root Login with a Password (Insecure)</xccdf-1.2:title>
              <xccdf-1.2:description>To disable password-based root logins over SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>PermitRootLogin prohibit-password</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">While this disables password-based root logins, direct root logins
through other means such as through SSH keys or GSSAPI will still be
permitted. Permitting any sort of root login remotely opens up the
root account to attack.
To fully disable direct root logins over SSH (which is considered a
best practice) and prevent remote attacks against the root account,
see CCE-27100-7, CCE-27445-6, CCE-80901-2, and similar.</xccdf-1.2:warning>
              <xccdf-1.2:rationale>Even though the communications channel may be encrypted, an additional
layer of security is gained by preventing use of a password.
This also helps to minimize direct attack attempts on root's password.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_root_password_login" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitRootLogin prohibit-password" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_root_password_login" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_password_login

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_password_login

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PermitRootLogin.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_password_login

- name: Disable SSH root Login with a Password (Insecure)
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitRootLogin\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitRootLogin\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitRootLogin\s+
      line: PermitRootLogin prohibit-password
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_password_login
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_root_password_login:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_root_password_login_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" severity="medium">
              <xccdf-1.2:title>Disable SSH TCP Forwarding</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>AllowTcpForwarding</html:code> parameter specifies whether TCP forwarding is permitted.
To disable TCP forwarding, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>AllowTcpForwarding no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Leaving port forwarding enabled can expose the organization to security risks and back-doors.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_tcp_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*AllowTcpForwarding/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "AllowTcpForwarding no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_tcp_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*AllowTcpForwarding.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Disable SSH TCP Forwarding
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*AllowTcpForwarding\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*AllowTcpForwarding\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*AllowTcpForwarding\s+
      line: AllowTcpForwarding no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_tcp_forwarding:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" severity="medium">
              <xccdf-1.2:title>Disable SSH Support for User Known Hosts</xccdf-1.2:title>
              <xccdf-1.2:description>SSH can allow system users to connect to systems if a cache of the remote
systems public keys is available.  This should be disabled.
<html:br/>
        <html:br/>
To ensure this behavior is disabled, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>IgnoreUserKnownHosts yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002349</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271712r1091848_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Configuring this setting for the SSH daemon provides additional
assurance that remote login via SSH will require a password, even
in the event of misconfiguration elsewhere.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_user_known_hosts" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*IgnoreUserKnownHosts/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*IgnoreUserKnownHosts\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "IgnoreUserKnownHosts yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_user_known_hosts" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002349
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_user_known_hosts

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002349
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_user_known_hosts

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*IgnoreUserKnownHosts.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002349
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_user_known_hosts

- name: Disable SSH Support for User Known Hosts
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*IgnoreUserKnownHosts\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*IgnoreUserKnownHosts\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*IgnoreUserKnownHosts\s+
      line: IgnoreUserKnownHosts yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002349
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_user_known_hosts
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_user_known_hosts:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" severity="medium">
              <xccdf-1.2:title>Disable X11 Forwarding</xccdf-1.2:title>
              <xccdf-1.2:description>The X11Forwarding parameter provides the ability to tunnel X11 traffic
through the connection to enable remote graphic connections.
SSH has the capability to encrypt remote X11 connections when SSH's
<html:code>X11Forwarding</html:code> option is enabled.
<html:br/>
The default SSH configuration disables X11Forwarding. The appropriate
configuration is used if no value is set for <html:code>X11Forwarding</html:code>.
<html:br/>
To explicitly disable X11 Forwarding, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>X11Forwarding no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002350</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271713r1091851_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Disable X11 forwarding unless there is an operational requirement to use X11
applications directly. There is a small risk that the remote X11 servers of
users who are logged in via SSH with X11 forwarding could be compromised by
other users on the X11 server. Note that even if X11 forwarding is disabled,
users can always install their own forwarders.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_disable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*X11Forwarding/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "X11Forwarding no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_disable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002350
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002350
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*X11Forwarding.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002350
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Disable X11 Forwarding
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11Forwarding\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11Forwarding\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11Forwarding\s+
      line: X11Forwarding no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002350
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_disable_x11_forwarding:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" severity="medium">
              <xccdf-1.2:title>Do Not Allow SSH Environment Options</xccdf-1.2:title>
              <xccdf-1.2:description>Ensure that users are not able to override environment variables of the SSH daemon.
<html:br/>
The default SSH configuration disables environment processing. The appropriate
configuration is used if no value is set for <html:code>PermitUserEnvironment</html:code>.
<html:br/>
To explicitly disable Environment options, add or correct the following


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>PermitUserEnvironment no</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002358</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271720r1091872_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH environment options potentially allow users to bypass
access restriction in some configurations.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_do_not_permit_user_env" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PermitUserEnvironment/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitUserEnvironment no" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_do_not_permit_user_env" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002358
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002358
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PermitUserEnvironment.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002358
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Do Not Allow SSH Environment Options
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
      line: PermitUserEnvironment no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-002358
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_do_not_permit_user_env:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_gssapi_auth" severity="medium">
              <xccdf-1.2:title>Enable GSSAPI Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Sites setup to use Kerberos or other GSSAPI Authenticaion require setting
sshd to accept this authentication.
To enable GSSAPI authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>GSSAPIAuthentication yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:rationale>Kerberos authentication for SSH is often implemented using GSSAPI. If
Kerberos is enabled through SSH, the SSH daemon provides a means of access
to the system's Kerberos implementation. Vulnerabilities in the system's
Kerberos implementations may be subject to exploitation.

For enterprises, Kerberos is often enabled and used with GSSAPI for 
centralized user account management which may necessitate enabling of
GSSAPI functionality in SSH. </xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*GSSAPIAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "GSSAPIAuthentication yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_gssapi_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_gssapi_auth

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_gssapi_auth

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*GSSAPIAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_gssapi_auth

- name: Enable GSSAPI Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
      line: GSSAPIAuthentication yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_gssapi_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_gssapi_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_gssapi_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_pam" severity="medium">
              <xccdf-1.2:title>Enable PAM</xccdf-1.2:title>
              <xccdf-1.2:description>UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
enable PAM authentication using ChallengeResponseAuthentication and
PasswordAuthentication in addition to PAM account and session module processing for all
authentication types.

To enable PAM authentication, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>UsePAM yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000877</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002344</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271707r1091833_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When UsePAM is set to yes, PAM runs through account and session types properly. This is
important if you want to restrict access to services based off of IP, time or other factors of
the account. Additionally, you can make sure users inherit certain environment variables
on login or disallow access to the server.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_pam" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*UsePAM/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "UsePAM yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_pam" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002344
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002344
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*UsePAM.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002344
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Enable PAM
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*UsePAM\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*UsePAM\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*UsePAM\s+
      line: UsePAM yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002344
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_pam:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_pubkey_auth" severity="medium">
              <xccdf-1.2:title>Enable Public Key Authentication</xccdf-1.2:title>
              <xccdf-1.2:description>Enable SSH login with public keys.
<html:br/>
The default SSH configuration enables authentication based on public keys. The appropriate
configuration is used if no value is set for <html:code>PubkeyAuthentication</html:code>.
<html:br/>
To explicitly enable Public Key Authentication, add or correct the following


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>PubkeyAuthentication yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002359</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271721r1091875_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without the use of multifactor authentication, the ease of access to
privileged functions is greatly increased. Multifactor authentication
requires using two or more factors to achieve authentication.
A privileged account is defined as an information system account with
authorizations of a privileged user. 
The DoD CAC with DoD-approved PKI is an example of multifactor
authentication.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PubkeyAuthentication\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PubkeyAuthentication yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_pubkey_auth" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002359
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pubkey_auth

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002359
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pubkey_auth

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PubkeyAuthentication.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002359
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pubkey_auth

- name: Enable Public Key Authentication
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PubkeyAuthentication\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PubkeyAuthentication\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PubkeyAuthentication\s+
      line: PubkeyAuthentication yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002359
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pubkey_auth
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_pubkey_auth:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_pubkey_auth_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" severity="medium">
              <xccdf-1.2:title>Enable Use of Strict Mode Checking</xccdf-1.2:title>
              <xccdf-1.2:description>SSHs <html:code>StrictModes</html:code> option checks file and ownership permissions in
the user's home directory <html:code>.ssh</html:code> folder before accepting login. If world-
writable permissions are found, logon is rejected.
<html:br/>
The default SSH configuration has <html:code>StrictModes</html:code> enabled. The appropriate
configuration is used if no value is set for <html:code>StrictModes</html:code>.
<html:br/>
To explicitly enable <html:code>StrictModes</html:code> in SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>StrictModes yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002351</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271714r1091854_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>If other users have access to modify user-specific SSH configuration files, they
may be able to log into the system as another user.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_strictmodes" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*StrictModes/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*StrictModes\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "StrictModes yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_strictmodes" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002351
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_strictmodes

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002351
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_strictmodes

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*StrictModes.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002351
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_strictmodes

- name: Enable Use of Strict Mode Checking
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*StrictModes\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*StrictModes\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*StrictModes\s+
      line: StrictModes yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002351
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_strictmodes
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_strictmodes:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" severity="medium">
              <xccdf-1.2:title>Enable SSH Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description>To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>Banner /etc/issue</html:pre>
Another section contains information on how to create an
appropriate system-wide warning banner.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FTA_TAB.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000256</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271487r1091173_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution.</xccdf-1.2:rationale>
              <xccdf-1.2:conflicts idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_warning_banner" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*Banner/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "Banner /etc/issue" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_warning_banner" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-000256
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-000256
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*Banner.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-000256
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner

- name: Enable SSH Warning Banner
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Banner\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Banner\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Banner\s+
      line: Banner /etc/issue
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - DISA-STIG-OL09-00-000256
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_warning_banner:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" severity="medium">
              <xccdf-1.2:title>Enable SSH Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description>To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in

<html:code>/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre>Banner /etc/issue.net</html:pre>
Another section contains information on how to create an
appropriate system-wide warning banner.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000048</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000050</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001384</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001385</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001386</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001387</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001388</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL4</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution.</xccdf-1.2:rationale>
              <xccdf-1.2:conflicts idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_warning_banner_net" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*Banner/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "Banner /etc/issue.net" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_warning_banner_net" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*Banner.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Enable SSH Warning Banner
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Banner\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Banner\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*Banner\s+
      line: Banner /etc/issue.net
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_warning_banner_net:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_warning_banner_net_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" severity="high">
              <xccdf-1.2:title>Enable Encrypted X11 Forwarding</xccdf-1.2:title>
              <xccdf-1.2:description>By default, remote X11 connections are not encrypted when initiated
by users. SSH has the capability to encrypt remote X11 connections when SSH's
<html:code>X11Forwarding</html:code> option is enabled.
<html:br/>
        <html:br/>
To enable X11 Forwarding, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>X11Forwarding yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.08</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI07.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands
remotely.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_enable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*X11Forwarding/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "X11Forwarding yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_enable_x11_forwarding" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_x11_forwarding

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_x11_forwarding

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*X11Forwarding.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_x11_forwarding

- name: Enable Encrypted X11 Forwarding
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11Forwarding\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11Forwarding\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11Forwarding\s+
      line: X11Forwarding yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_x11_forwarding
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_enable_x11_forwarding:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" severity="unknown">
              <xccdf-1.2:title>Limit Users' SSH Access</xccdf-1.2:title>
              <xccdf-1.2:description>By default, the SSH configuration allows any user with an account
to access the system. There are several options available to limit
which users and group can access the system via SSH. It is
recommended that at least one of the following options be leveraged:
- AllowUsers variable gives the system administrator the option of
  allowing specific users to ssh into the system. The list consists of
  space separated user names. Numeric user IDs are not recognized with
  this variable. If a system administrator wants to restrict user
  access further by specifically allowing a user's access only from a
  particular host, the entry can be specified in the form of user@host.
- AllowGroups variable gives the system administrator the option of
  allowing specific groups of users to ssh into the system. The list
  consists of space separated group names. Numeric group IDs are not
  recognized with this variable.
- DenyUsers variable gives the system administrator the option of
  denying specific users to ssh into the system. The list consists of
  space separated user names. Numeric user IDs are not recognized with
  this variable. If a system administrator wants to restrict user
  access further by specifically denying a user's access from a
  particular host, the entry can be specified in the form of user@host.
- DenyGroups variable gives the system administrator the option of
  denying specific groups of users to ssh into the system. The list
  consists of space separated group names. Numeric group IDs are not
  recognized with this variable.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Automated remediation is not available for this configuration check
because each system has unique user names and group names.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.11.SEC-OL2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Specifying which accounts are allowed SSH access into the system reduces the
possibility of unauthorized access to the system.</xccdf-1.2:rationale>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_limit_user_access:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_print_last_log" severity="medium">
              <xccdf-1.2:title>Enable SSH Print Last Log</xccdf-1.2:title>
              <xccdf-1.2:description>Ensure that SSH will display the date and time of the last successful account logon.
<html:br/>
The default SSH configuration enables print of the date and time of the last login.
The appropriate configuration is used if no value is set for <html:code>PrintLastLog</html:code>.
<html:br/>
To explicitly enable LastLog in SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>PrintLastLog yes</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002352</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271715r1091857_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Providing users feedback on when account accesses last occurred facilitates user
recognition and reporting of unauthorized account use.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_print_last_log" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*PrintLastLog/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PrintLastLog\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "PrintLastLog yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_print_last_log" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002352
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_print_last_log

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002352
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_print_last_log

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*PrintLastLog.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002352
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_print_last_log

- name: Enable SSH Print Last Log
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PrintLastLog\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PrintLastLog\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*PrintLastLog\s+
      line: PrintLastLog yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002352
  - NIST-800-53-AC-9
  - NIST-800-53-AC-9(1)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_print_last_log
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_print_last_log:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" severity="medium">
              <xccdf-1.2:title>Force frequent session key renegotiation</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>RekeyLimit</html:code> parameter specifies how often
the session key of the is renegotiated, both in terms of
amount of data that may be transmitted and the time
elapsed.<html:br/>
To decrease the default limits, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>RekeyLimit <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>
         <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000068</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002418</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002342</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271705r1091827_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>By decreasing the limit based on the amount of data and enabling
time-based limit, effects of potential attacks against
encryption keys are limited.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_rekey_limit"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_rekey_limit_size='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>'
var_rekey_limit_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>'




# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*RekeyLimit/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*RekeyLimit\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "RekeyLimit $var_rekey_limit_size $var_rekey_limit_time" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_rekey_limit" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002342
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sshd_rekey_limit
- name: XCCDF Value var_rekey_limit_size # promote to variable
  set_fact:
    var_rekey_limit_size: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_rekey_limit_time # promote to variable
  set_fact:
    var_rekey_limit_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002342
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sshd_rekey_limit

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*RekeyLimit.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002342
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sshd_rekey_limit

- name: Force frequent session key renegotiation
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*RekeyLimit\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*RekeyLimit\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*RekeyLimit\s+
      line: RekeyLimit {{ var_rekey_limit_size }} {{ var_rekey_limit_time }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002342
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sshd_rekey_limit
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_rekey_limit_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_time"/>
                <xccdf-1.2:check-export export-name="oval:ssg-var_rekey_limit_size:var:1" value-id="xccdf_org.ssgproject.content_value_var_rekey_limit_size"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_rekey_limit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" severity="medium">
              <xccdf-1.2:title>Ensure SSH LoginGraceTime is configured</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>LoginGraceTime</html:code> parameter to the SSH server specifies the time allowed for successful authentication to
the SSH server. The longer the Grace period is the more open unauthenticated connections
can exist. Like other session controls in this session the Grace Period should be limited to
appropriate limits to ensure the service is available for needed access.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting the <html:code>LoginGraceTime</html:code> parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. It will also limit the number of concurrent
unauthenticated connections.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_login_grace_time" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_sshd_set_login_grace_time='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*LoginGraceTime/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*LoginGraceTime\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "LoginGraceTime $var_sshd_set_login_grace_time" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_login_grace_time" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time
- name: XCCDF Value var_sshd_set_login_grace_time # promote to variable
  set_fact:
    var_sshd_set_login_grace_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*LoginGraceTime.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time

- name: Ensure SSH LoginGraceTime is configured
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LoginGraceTime\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LoginGraceTime\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LoginGraceTime\s+
      line: LoginGraceTime {{ var_sshd_set_login_grace_time }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_login_grace_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_login_grace_time:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_login_grace_time_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_info" severity="low">
              <xccdf-1.2:title>Set LogLevel to INFO</xccdf-1.2:title>
              <xccdf-1.2:description>The INFO parameter specifices that record login and logout activity will be logged.
<html:br/>
The default SSH configuration sets the log level to INFO. The appropriate
configuration is used if no value is set for <html:code>LogLevel</html:code>.
<html:br/>
To explicitly specify the log level in SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>LogLevel INFO</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH provides several logging levels with varying amounts of verbosity. <html:code>DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code>INFO</html:code> level is the
basic level that only records login activity of SSH users. In many situations, such as Incident
Response, it is important to determine when a particular user was active on a system. The
logout record can eliminate those users who disconnected, which helps narrow the field.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_loglevel_info" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*LogLevel/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "LogLevel INFO" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_loglevel_info" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_info

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_info

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*LogLevel.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_info

- name: Set LogLevel to INFO
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LogLevel\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LogLevel\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LogLevel\s+
      line: LogLevel INFO
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_info
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_loglevel_info:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" severity="medium">
              <xccdf-1.2:title>Set SSH Daemon LogLevel to VERBOSE</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>VERBOSE</html:code> parameter configures the SSH daemon to record login and logout activity.
To specify the log level in
SSH, add or correct the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:pre>LogLevel VERBOSE</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000067</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000032-GPOS-00013</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002340</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271703r1091821_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH provides several logging levels with varying amounts of verbosity. <html:code>DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code>INFO</html:code> or
<html:code>VERBOSE</html:code> level is the basic level that only records login activity of SSH users. In many
situations, such as Incident Response, it is important to determine when a particular user was active
on a system. The logout record can eliminate those users who disconnected, which helps narrow the
field.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_loglevel_verbose" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*LogLevel/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "LogLevel VERBOSE" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_loglevel_verbose" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002340
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002340
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*LogLevel.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002340
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Set SSH Daemon LogLevel to VERBOSE
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LogLevel\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LogLevel\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*LogLevel\s+
      line: LogLevel VERBOSE
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002340
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_loglevel_verbose:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" severity="medium">
              <xccdf-1.2:title>Set SSH authentication attempt limit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>MaxAuthTries</html:code> parameter specifies the maximum number of authentication attempts
permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
to set MaxAUthTries edit <html:code>/etc/ssh/sshd_config</html:code> as follows:
<html:pre>MaxAuthTries <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Setting the MaxAuthTries parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_max_auth_tries" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

sshd_max_auth_tries_value='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*MaxAuthTries/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxAuthTries\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "MaxAuthTries $sshd_max_auth_tries_value" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_max_auth_tries" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries
- name: XCCDF Value sshd_max_auth_tries_value # promote to variable
  set_fact:
    sshd_max_auth_tries_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*MaxAuthTries.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries

- name: Set SSH authentication attempt limit
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxAuthTries\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxAuthTries\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxAuthTries\s+
      line: MaxAuthTries {{ sshd_max_auth_tries_value }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_max_auth_tries_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_max_auth_tries:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" severity="medium">
              <xccdf-1.2:title>Set SSH MaxSessions limit</xccdf-1.2:title>
              <xccdf-1.2:description>The <html:code>MaxSessions</html:code> parameter specifies the maximum number of open sessions permitted
from a given connection. To set MaxSessions edit
<html:code>/etc/ssh/sshd_config</html:code> as follows: <html:pre>MaxSessions <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To protect a system from denial of service due to a large number of concurrent
sessions, use the rate limiting function of MaxSessions to protect availability
of sshd logins and prevent overwhelming the daemon.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_max_sessions" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_sshd_max_sessions='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*MaxSessions/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "MaxSessions $var_sshd_max_sessions" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_max_sessions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions
- name: XCCDF Value var_sshd_max_sessions # promote to variable
  set_fact:
    var_sshd_max_sessions: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*MaxSessions.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions

- name: Set SSH MaxSessions limit
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxSessions\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxSessions\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxSessions\s+
      line: MaxSessions {{ var_sshd_max_sessions }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_max_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_max_sessions:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" severity="medium">
              <xccdf-1.2:title>Ensure SSH MaxStartups is configured</xccdf-1.2:title>
              <xccdf-1.2:description>The MaxStartups parameter specifies the maximum number of concurrent unauthenticated
connections to the SSH daemon. Additional connections will be dropped until authentication
succeeds or the LoginGraceTime expires for a connection. To configure MaxStartups, you should
add or edit the following line in the <html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>MaxStartups <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale>To protect a system from denial of service due to a large number of pending authentication
connection attempts, use the rate limiting function of MaxStartups to protect availability of
sshd logins and prevent overwhelming the daemon.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_set_maxstartups" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_sshd_set_maxstartups='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*MaxStartups/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxStartups\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "MaxStartups $var_sshd_set_maxstartups" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_set_maxstartups" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups
- name: XCCDF Value var_sshd_set_maxstartups # promote to variable
  set_fact:
    var_sshd_set_maxstartups: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*MaxStartups.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups

- name: Ensure SSH MaxStartups is configured
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxStartups\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxStartups\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MaxStartups\s+
      line: MaxStartups {{ var_sshd_set_maxstartups }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_maxstartups:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_set_maxstartups:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_use_directory_configuration" severity="medium">
              <xccdf-1.2:title>Distribute the SSH Server configuration to multiple files in a config directory.</xccdf-1.2:title>
              <xccdf-1.2:description>Make sure to have the <html:code>Include /etc/ssh/sshd_config.d/*.conf</html:code> line in the <html:code>/etc/ssh/sshd_config</html:code> file.
Ideally, don't have any active configuration directives in that file, and distribute the service configuration
to several files in the <html:code>/etc/ssh/sshd_config.d</html:code> directory.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>This form of distributed configuration is considered as a good practice, and as other sshd rules assume that directives in files in the <html:code>/etc/ssh/sshd_config.d</html:code> config directory are effective, there has to be a rule that ensures this.
Aside from that, having multiple configuration files makes the SSH Server configuration changes easier to partition according to the reason that they were introduced, and therefore it should help to perform merges of hardening updates.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_use_directory_configuration"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if test -f /etc/ssh/sshd_config.d/sshd_config_original.conf; then
	printf '%s\n' "Remediation probably already happened, '/etc/ssh/sshd_config.d/sshd_config_original.conf' already exists, not doing anything." &gt;&amp;2
false 1
elif grep -Eq '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf' /etc/ssh/sshd_config &amp;&amp; ! grep -Eq '^\s*Match\s' /etc/ssh/sshd_config; then
	printf '%s\n' "Remediation probably already happened, '/etc/ssh/sshd_config' already contains the include directive." &gt;&amp;2
false 1
else
	mkdir -p /etc/ssh/sshd_config.d
	mv /etc/ssh/sshd_config /etc/ssh/sshd_config.d/sshd_config_original.conf
cat &gt; /etc/ssh/sshd_config &lt;&lt; EOF
# To modify the system-wide sshd configuration, create a  *.conf  file under
#  /etc/ssh/sshd_config.d/  which will be automatically included below

Include /etc/ssh/sshd_config.d/*.conf
EOF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_use_directory_configuration:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_use_directory_configuration_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" severity="medium">
              <xccdf-1.2:title>Enable Use of Privilege Separation</xccdf-1.2:title>
              <xccdf-1.2:description>When enabled, SSH will create an unprivileged child process that
has the privilege of the authenticated user. To enable privilege separation in
SSH, add or correct the following line in the <html:code>/etc/ssh/sshd_config</html:code> file:
<html:pre>UsePrivilegeSeparation <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>SSH daemon privilege separation causes the SSH process to drop root privileges
when not needed which would decrease the impact of software vulnerabilities in
the unprivileged section.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_use_priv_separation" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_sshd_priv_separation='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>'



# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*UsePrivilegeSeparation/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*UsePrivilegeSeparation\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "UsePrivilegeSeparation $var_sshd_priv_separation" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_use_priv_separation" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_priv_separation
- name: XCCDF Value var_sshd_priv_separation # promote to variable
  set_fact:
    var_sshd_priv_separation: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_priv_separation

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*UsePrivilegeSeparation.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_priv_separation

- name: Enable Use of Privilege Separation
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*UsePrivilegeSeparation\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*UsePrivilegeSeparation\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*UsePrivilegeSeparation\s+
      line: UsePrivilegeSeparation {{ var_sshd_priv_separation }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_priv_separation
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_priv_separation:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_use_priv_separation:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_use_strong_macs" severity="medium">
              <xccdf-1.2:title>Use Only Strong MACs</xccdf-1.2:title>
              <xccdf-1.2:description>Limit the MACs to strong hash algorithms.
The following line in <html:code>/etc/ssh/sshd_config</html:code> demonstrates use
of those MACs:
<html:pre>MACs <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_strong_macs" use="legacy"/>
        </html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17 (2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000262</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271490r1092628_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase
exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of
attention as a weak spot that can be exploited with expanded computing power. An
attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the
SSH tunnel and capture credentials and information</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_use_strong_macs"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

sshd_strong_macs='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_strong_macs" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^MACs")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$sshd_strong_macs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^MACs\\&gt;" "/etc/ssh/sshd_config"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^MACs\\&gt;.*/$escaped_formatted_output/gi" "/etc/ssh/sshd_config"
else
    if [[ -s "/etc/ssh/sshd_config" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/ssh/sshd_config" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/ssh/sshd_config"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/ssh/sshd_config"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_use_strong_macs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000262
  - NIST-800-53-AC-17 (2)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_strong_macs
- name: XCCDF Value sshd_strong_macs # promote to variable
  set_fact:
    sshd_strong_macs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_strong_macs" use="legacy"/>
  tags:
    - always

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000262
  - NIST-800-53-AC-17 (2)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_strong_macs

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*MACs.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000262
  - NIST-800-53-AC-17 (2)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_strong_macs

- name: Use Only Strong MACs
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MACs\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MACs\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*MACs\s+
      line: MACs {{ sshd_strong_macs }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000262
  - NIST-800-53-AC-17 (2)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_use_strong_macs
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_strong_macs:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_strong_macs"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_use_strong_macs:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_use_strong_macs_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sshd_x11_use_localhost" severity="medium">
              <xccdf-1.2:title>Prevent remote hosts from connecting to the proxy display</xccdf-1.2:title>
              <xccdf-1.2:description>The SSH daemon should prevent remote hosts from connecting to the proxy
display.
<html:br/>
The default SSH configuration for <html:code>X11UseLocalhost</html:code> is <html:code>yes</html:code>,
which prevents remote hosts from connecting to the proxy display.
<html:br/>
To explicitly prevent remote connections to the proxy display, add or correct
the following line in


<html:code>/etc/ssh/sshd_config</html:code>:

<html:code>X11UseLocalhost yes</html:code>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002354</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271716r1091860_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>When X11 forwarding is enabled, there may be additional exposure to the
server and client displays if the sshd proxy display is configured to listen
on the wildcard address. By default, sshd binds the forwarding server to the
loopback address and sets the hostname part of the <html:code>DISPLAY</html:code>
environment variable to localhost. This prevents remote hosts from
connecting to the proxy display.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_x11_use_localhost" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Find the include keyword, extract from the line the glob expression representing included files.
# And if it is a relative path prepend '/etc/ssh/'
included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*include\s*//I' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
for included_file in ${included_files} ; do
    
    LC_ALL=C sed -i "/^\s*X11UseLocalhost/Id" "$included_file"
done

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11UseLocalhost\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config"

cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert at the beginning of the file
printf '%s\n' "X11UseLocalhost yes" &gt; "/etc/ssh/sshd_config"
cat "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sshd_x11_use_localhost" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002354
  - NIST-800-53-CM-6(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_x11_use_localhost

- name: Find sshd_config included files
  shell: |-
    included_files=$(grep -oP "^\s*(?i)include.*" /etc/ssh/sshd_config | sed -e 's/\s*Include\s*//i' | sed -e 's|^[^/]|/etc/ssh/&amp;|')
    [[ -n $included_files ]] &amp;&amp; ls $included_files || true
  register: sshd_config_included_files
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002354
  - NIST-800-53-CM-6(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_x11_use_localhost

- name: Comment conf from included files
  replace:
    path: '{{ item }}'
    regexp: ^(\s*X11UseLocalhost.*)$
    replace: '# \1'
  loop: '{{ sshd_config_included_files.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002354
  - NIST-800-53-CM-6(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_x11_use_localhost

- name: Prevent remote hosts from connecting to the proxy display
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11UseLocalhost\s+
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11UseLocalhost\s+
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/ssh/sshd_config
    lineinfile:
      path: /etc/ssh/sshd_config
      create: true
      regexp: (?i)(?i)^\s*X11UseLocalhost\s+
      line: X11UseLocalhost yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-002354
  - NIST-800-53-CM-6(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_x11_use_localhost
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sshd_x11_use_localhost:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sshd_x11_use_localhost_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sssd">
          <xccdf-1.2:title>System Security Services Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br/>
      <html:br/>
For more information, see
    <html:a href="https://docs.oracle.com/en/operating-systems/oracle-linux/9/userauth/userauth-UsingtheSystemSecurityServicesDaemon.html">https://docs.oracle.com/en/operating-systems/oracle-linux/9/userauth/userauth-UsingtheSystemSecurityServicesDaemon.html</html:a>
     </xccdf-1.2:description>
          <xccdf-1.2:platform idref="#package_sssd"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" type="string" interactive="true">
            <xccdf-1.2:title>SSSD certificate_verification option</xccdf-1.2:title>
            <xccdf-1.2:description>Value of the certificate_verification option in
the SSSD config.</xccdf-1.2:description>
            <xccdf-1.2:value selector="sha1">sha1</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha256">sha256</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha384">sha384</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha512">sha512</xccdf-1.2:value>
            <xccdf-1.2:value>sha1</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_sssd_installed" severity="medium">
            <xccdf-1.2:title>Install the SSSD Package</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>sssd</html:code> package should be installed.
The <html:code>sssd</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install sssd</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R67</xccdf-1.2:reference>
            <xccdf-1.2:rationale/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_sssd_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

if ! rpm -q --quiet "sssd" ; then
    yum install -y "sssd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_sssd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sssd_installed

- name: Ensure sssd is installed
  package:
    name: sssd
    state: present
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sssd_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_sssd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_sssd

class install_sssd {
  package { 'sssd':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_sssd_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=sssd
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_sssd_installed">
[[packages]]
name = "sssd"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_sssd_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_sssd_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_sssd_enabled" severity="medium">
            <xccdf-1.2:title>Enable the SSSD Service</xccdf-1.2:title>
            <xccdf-1.2:description>The SSSD service should be enabled.

The <html:code>sssd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable sssd.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">The service requires a valid sssd configuration. If the configuration is not present, the service will fail to start and consequently this rule will be reported as failing. The configuration shipped in your distribution package might not be sufficient. Manual modification of configuration files might be required.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(10)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R67</xccdf-1.2:reference>
            <xccdf-1.2:rationale/>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_sssd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { rpm --quiet -q kernel || rpm --quiet -q kernel-uek; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'sssd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'sssd.service'
fi
"$SYSTEMCTL_EXEC" enable 'sssd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_sssd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(10)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_sssd_enabled

- name: Enable the SSSD Service - Enable service sssd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable the SSSD Service - Enable Service sssd
    ansible.builtin.systemd:
      name: sssd
      enabled: true
      state: started
      masked: false
    when:
    - '"sssd-common" in ansible_facts.packages'
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(10)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_sssd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_sssd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_sssd

class enable_sssd {
  service {'sssd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_sssd_enabled">
[customizations.services]
enabled = ["sssd"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_sssd_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_sssd_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_certificate_verification" severity="medium">
            <xccdf-1.2:title>Certificate status checking in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description>Multifactor solutions that require devices separate from information systems gaining access include,
for example, hardware tokens providing time-based or challenge-response authenticators and smart cards.
Configuring <html:code>certificate_verification</html:code> to <html:code>ocsp_dgst=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" use="legacy"/>
       </html:code> ensures that certificates for
multifactor solutions are checked via Online Certificate Status Protocol (OCSP).</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000930</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271608r1091536_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Ensuring that multifactor solutions certificates are checked via Online Certificate Status Protocol (OCSP)
ensures the security of the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_certificate_verification" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

var_sssd_certificate_verification_digest_function='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" use="legacy"/>'


# sssd configuration files must be created with 600 permissions if they don't exist
# otherwise the sssd module fails to start
OLD_UMASK=$(umask)
umask u=rw,go=

MAIN_CONF="/etc/sssd/conf.d/certificate_verification.conf"

found=false

# set value in all files if they contain section or key
for f in $(echo -n "$MAIN_CONF /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[sssd\]([^\n\[]*\n+)+?[[:space:]]*certificate_verification" "$f"; then

            sed -i "s/certificate_verification[^(\n)]*/certificate_verification=ocsp_dgst=$var_sssd_certificate_verification_digest_function/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[sssd\]" "$f"; then

            sed -i "/[[:space:]]*\[sssd\]/a certificate_verification=ocsp_dgst=$var_sssd_certificate_verification_digest_function" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "$MAIN_CONF /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[sssd]\ncertificate_verification=ocsp_dgst=$var_sssd_certificate_verification_digest_function" &gt;&gt; "$file"

fi

umask $OLD_UMASK

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_certificate_verification" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000930
  - NIST-800-53-IA-2(11)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_certificate_verification
- name: XCCDF Value var_sssd_certificate_verification_digest_function # promote to variable
  set_fact:
    var_sssd_certificate_verification_digest_function: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" use="legacy"/>
  tags:
    - always

- name: Ensure that "certificate_verification" is not set in /etc/sssd/sssd.conf
  ini_file:
    path: /etc/sssd/sssd.conf
    section: sssd
    option: certificate_verification
    state: absent
    mode: 384
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000930
  - NIST-800-53-IA-2(11)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_certificate_verification

- name: Ensure that "certificate_verification" is not set in  /etc/sssd/conf.d/*.conf
  ini_file:
    path: /etc/sssd/conf.d/*.conf
    section: sssd
    option: certificate_verification
    state: absent
    mode: 384
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000930
  - NIST-800-53-IA-2(11)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_certificate_verification

- name: Ensure that "certificate_verification" is set
  ini_file:
    path: /etc/sssd/conf.d/certificate_verification.conf
    section: sssd
    option: certificate_verification
    value: ocsp_dgst={{ var_sssd_certificate_verification_digest_function }}
    state: present
    mode: 384
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000930
  - NIST-800-53-IA-2(11)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_certificate_verification
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" value-id="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_certificate_verification:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_certificate_verification_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_enable_certmap" severity="medium">
            <xccdf-1.2:title>Enable Certmap in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to verify the certificate of the user or group. To set this up
 ensure that section like <html:code>certmap/testing.test/rule_name</html:code> is setup in
<html:code>/etc/sssd/sssd.conf</html:code>. For example
<html:pre>
[certmap/testing.test/rule_name]
matchrule =&lt;SAN&gt;.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test
</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available, since all of the settings in
in the certmap need to be customized.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000187</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5 (2) (c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000068-GPOS-00036</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000910</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271606r1091530_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without mapping the certificate used to authenticate to the user account, the ability to
determine the identity of the individual user or group will not be available for forensic
analysis.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_enable_certmap:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_enable_certmap_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_enable_pam_services" severity="medium">
            <xccdf-1.2:title>Configure PAM in SSSD Services</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to run SSSD <html:code>pam</html:code> services.
To configure SSSD to known SSH hosts, add <html:code>pam</html:code>
to <html:code>services</html:code> under the <html:code>[sssd]</html:code> section in
<html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[sssd]
services = sudo, autofs, pam
</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000377-GPOS-00162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R67</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_enable_pam_services"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

# sssd configuration files must be created with 600 permissions if they don't exist
# otherwise the sssd module fails to start
OLD_UMASK=$(umask)
umask u=rw,go=

SSSD_CONF="/etc/sssd/sssd.conf"
SSSD_CONF_DIR="/etc/sssd/conf.d/*.conf"

if [ ! -f "$SSSD_CONF" ] &amp;&amp; [ ! -f "$SSSD_CONF_DIR" ]; then
    mkdir -p /etc/sssd
    touch "$SSSD_CONF"
fi

# Flag to check if there is already services with pam
service_already_exist=false
for f in $SSSD_CONF $SSSD_CONF_DIR; do
	if [ ! -e "$f" ]; then
		continue
	fi
	# finds all services entries under [sssd] configuration category, get a unique list so it doesn't add redundant fix
	services_list=$( awk '/^\s*\[/{f=0} /^\s*\[sssd\]/{f=1}f' $f | grep -P '^services[ \t]*=' | uniq )
    if [ -z "$services_list" ]; then
        continue
    fi

	while IFS= read -r services; do
		if [[ ! $services =~ "pam" ]]; then
			sed -i "s/$services$/&amp;, pam/" $f
		fi
        # Either pam service was already there or got added now
        service_already_exist=true
	done &lt;&lt;&lt; "$services_list"

done

# If there was no service in [sssd], add it to first config
if [ "$service_already_exist" = false ]; then
    for f in $SSSD_CONF $SSSD_CONF_DIR; do
        cat &lt;&lt; EOF &gt;&gt; "$f"
[sssd]
services = pam
EOF
        break
    done
fi

umask $OLD_UMASK

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_enable_pam_services" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Find all the conf files inside the /etc/sssd/conf.d/
    directory
  ansible.builtin.find:
    paths:
    - /etc/sssd/conf.d/
    patterns: '*.conf'
  register: sssd_conf_d_files
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Modify lines in files in the /etc/sssd/conf.d/
    directory
  ansible.builtin.replace:
    path: '{{ item }}'
    regexp: ^(\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*services\s*=(?!.*\bpam\b).*)$
    replace: \1,pam
  with_items: '{{ sssd_conf_d_files.files | map(attribute=''path'') }}'
  register: modify_lines_sssd_conf_d_files
  when:
  - '"sssd-common" in ansible_facts.packages'
  - sssd_conf_d_files.matched is defined and sssd_conf_d_files.matched &gt;= 1
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Find /etc/sssd/sssd.conf
  ansible.builtin.stat:
    path: /etc/sssd/sssd.conf
  register: sssd_conf_file
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Modify lines in /etc/sssd/sssd.conf
  ansible.builtin.replace:
    path: /etc/sssd/sssd.conf
    regexp: ^(\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*services\s*=(?!.*\bpam\b).*)$
    replace: \1,pam
  register: modify_lines_sssd_conf_file
  when:
  - '"sssd-common" in ansible_facts.packages'
  - sssd_conf_file.stat.exists
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Find services key in /etc/sssd/sssd.conf
  ansible.builtin.replace:
    path: /etc/sssd/sssd.conf
    regexp: ^\s*\[sssd\][^\[\]]*?(?:\n(?!\[)[^\n]*?services\s*=)+
    replace: ''
  changed_when: false
  check_mode: true
  register: sssd_conf_file_services
  when:
  - '"sssd-common" in ansible_facts.packages'
  - sssd_conf_file.stat.exists
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Insert entry to /etc/sssd/sssd.conf
  ini_file:
    path: /etc/sssd/sssd.conf
    section: sssd
    option: services
    value: pam
  when:
  - '"sssd-common" in ansible_facts.packages'
  - not modify_lines_sssd_conf_d_files.changed
  - not modify_lines_sssd_conf_file.changed
  - (sssd_conf_file_services.msg is defined and "replacements" not in sssd_conf_file_services.msg)
    or not sssd_conf_file.stat.exists
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_enable_pam_services:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_enable_pam_services_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" severity="medium">
            <xccdf-1.2:title>Enable Smartcards in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to authenticate access to the system using smart cards.
To enable smart cards in SSSD, set <html:code>pam_cert_auth</html:code> to <html:code>True</html:code> under the
<html:code>[pam]</html:code> section in <html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[pam]
pam_cert_auth = True
</html:pre>

Add or update "pam_sss.so" line in auth section of "/etc/pam.d/system-auth" file to include
"try_cert_auth" or "require_cert_auth" option, like in the following example:
<html:pre>
/etc/pam.d/system-auth:auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth
</html:pre>
Also add or update "pam_sss.so" line in auth section of "/etc/pam.d/smartcard-auth" file to
include the "allow_missing_name" option, like in the following example:
<html:pre>/etc/pam.d/smartcard-auth:auth sufficient pam_sss.so allow_missing_name</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004047</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004046</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0431</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000925</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271607r1091533_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/>
       <html:br/>
Multi-Factor Authentication (MFA) solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_enable_smartcards" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

# sssd configuration files must be created with 600 permissions if they don't exist
# otherwise the sssd module fails to start
OLD_UMASK=$(umask)
umask u=rw,go=

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[pam\]([^\n\[]*\n+)+?[[:space:]]*pam_cert_auth" "$f"; then

            sed -i "s/pam_cert_auth[^(\n)]*/pam_cert_auth=True/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[pam\]" "$f"; then

            sed -i "/[[:space:]]*\[pam\]/a pam_cert_auth=True" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[pam]\npam_cert_auth=True" &gt;&gt; "$file"

fi

umask $OLD_UMASK


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
    echo "
    authselect integrity check failed. Remediation aborted!
    This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
    It is not recommended to manually edit the PAM files when authselect tool is available.
    In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    exit 1
    fi
    authselect enable-feature with-smartcard

    authselect apply-changes -b
else
    

    if ! grep -qP "^\s*auth\s+sufficient\s+pam_sss.so\s*.*" "/etc/pam.d/smartcard-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*auth\s+.*\s+pam_sss.so\s*' "/etc/pam.d/smartcard-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*auth\s+).*(\bpam_sss.so.*)/\1sufficient \2/" "/etc/pam.d/smartcard-auth"
        else
            echo "auth    sufficient    pam_sss.so" &gt;&gt; "/etc/pam.d/smartcard-auth"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*auth\s+sufficient\s+pam_sss.so\s*.*\sallow_missing_name\b" "/etc/pam.d/smartcard-auth"; then
        sed -i -E --follow-symlinks "/\s*auth\s+sufficient\s+pam_sss.so.*/ s/$/ allow_missing_name/" "/etc/pam.d/smartcard-auth"
    fi
    

    if ! grep -qP "^\s*auth\s+\[success=done authinfo_unavail=ignore ignore=ignore default=die\]\s+pam_sss.so\s*.*" "/etc/pam.d/system-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*auth\s+.*\s+pam_sss.so\s*' "/etc/pam.d/system-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*auth\s+).*(\bpam_sss.so.*)/\1[success=done authinfo_unavail=ignore ignore=ignore default=die] \2/" "/etc/pam.d/system-auth"
        else
            echo "auth    [success=done authinfo_unavail=ignore ignore=ignore default=die]    pam_sss.so" &gt;&gt; "/etc/pam.d/system-auth"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*auth\s+\[success=done authinfo_unavail=ignore ignore=ignore default=die\]\s+pam_sss.so\s*.*\stry_cert_auth\b" "/etc/pam.d/system-auth"; then
        sed -i -E --follow-symlinks "/\s*auth\s+\[success=done authinfo_unavail=ignore ignore=ignore default=die\]\s+pam_sss.so.*/ s/$/ try_cert_auth/" "/etc/pam.d/system-auth"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_enable_smartcards" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Test for domain group
  command: grep '^\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  failed_when: false
  changed_when: false
  check_mode: false
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
  - section: sssd
    option: domains
    value: default
  - section: domain/default
    option: id_provider
    value: files
  when:
  - '"sssd-common" in ansible_facts.packages'
  - test_grep_domain.stdout is defined
  - test_grep_domain.stdout | length &lt; 1
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Enable Smartcards in SSSD
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: pam_cert_auth
    value: 'True'
    create: true
    mode: 384
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Find all the conf files inside /etc/sssd/conf.d/
  find:
    paths: /etc/sssd/conf.d/
    patterns: '*.conf'
  register: sssd_conf_d_files
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Fix pam_cert_auth configuration in /etc/sssd/conf.d/
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: '[^#]*pam_cert_auth.*'
    replace: pam_cert_auth = True
  with_items: '{{ sssd_conf_d_files.files }}'
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Enable Smartcards in SSSD - Check if system relies on authselect
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Enable Smartcards in SSSD - Remediate using authselect
  block:

  - name: Enable Smartcards in SSSD - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    failed_when: false

  - name: Enable Smartcards in SSSD - Informative message based on the authselect
      integrity check result
    ansible.builtin.assert:
      that:
      - result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Enable Smartcards in SSSD - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    when:
    - result_authselect_check_cmd is success

  - name: Enable Smartcards in SSSD - Ensure "with-smartcard" feature is enabled using
      authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-smartcard
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-smartcard")

  - name: Enable Smartcards in SSSD - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"sssd-common" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards

- name: Enable Smartcards in SSSD - Remediate by directly editing PAM files
  block:

  - name: Enable Smartcards in SSSD - Define a fact for control already filtered in
      case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Enable Smartcards in SSSD - Check if expected PAM module line is present
      in /etc/pam.d/smartcard-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/smartcard-auth
      regexp: ^\s*auth\s+{{ pam_module_control | regex_escape() }}\s+pam_sss.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Enable Smartcards in SSSD - Include or update the PAM module line in /etc/pam.d/smartcard-auth
    block:

    - name: Enable Smartcards in SSSD - Check if required PAM module line is present
        in /etc/pam.d/smartcard-auth with different control
      ansible.builtin.lineinfile:
        path: /etc/pam.d/smartcard-auth
        regexp: ^\s*auth\s+.*\s+pam_sss.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Enable Smartcards in SSSD - Ensure the correct control for the required
        PAM module line in /etc/pam.d/smartcard-auth
      ansible.builtin.replace:
        dest: /etc/pam.d/smartcard-auth
        regexp: ^(\s*auth\s+).*(\bpam_sss.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Enable Smartcards in SSSD - Ensure the required PAM module line is included
        in /etc/pam.d/smartcard-auth
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/smartcard-auth
        line: auth    {{ pam_module_control }}    pam_sss.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Enable Smartcards in SSSD - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Enable Smartcards in SSSD - Define a fact for control already filtered in
      case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Enable Smartcards in SSSD - Check if the required PAM module option is present
      in /etc/pam.d/smartcard-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/smartcard-auth
      regexp: ^\s*auth\s+{{ pam_module_control | regex_escape() }}\s+pam_sss.so\s*.*\sallow_missing_name\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_sssd_enable_smartcards_option_present

  - name: Enable Smartcards in SSSD - Ensure the "allow_missing_name" PAM option for
      "pam_sss.so" is included in /etc/pam.d/smartcard-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/smartcard-auth
      backrefs: true
      regexp: ^(\s*auth\s+{{ pam_module_control | regex_escape() }}\s+pam_sss.so.*)
      line: \1 allow_missing_name
      state: present
    register: result_pam_sssd_enable_smartcards_add
    when:
    - result_pam_module_sssd_enable_smartcards_option_present.found == 0

  - name: Enable Smartcards in SSSD - Define a fact for control already filtered in
      case filters are used
    ansible.builtin.set_fact:
      pam_module_control: '[success=done authinfo_unavail=ignore ignore=ignore default=die]'

  - name: Enable Smartcards in SSSD - Check if expected PAM module line is present
      in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: ^\s*auth\s+{{ pam_module_control | regex_escape() }}\s+pam_sss.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Enable Smartcards in SSSD - Include or update the PAM module line in /etc/pam.d/system-auth
    block:

    - name: Enable Smartcards in SSSD - Check if required PAM module line is present
        in /etc/pam.d/system-auth with different control
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: ^\s*auth\s+.*\s+pam_sss.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Enable Smartcards in SSSD - Ensure the correct control for the required
        PAM module line in /etc/pam.d/system-auth
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: ^(\s*auth\s+).*(\bpam_sss.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Enable Smartcards in SSSD - Ensure the required PAM module line is included
        in /etc/pam.d/system-auth
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/system-auth
        line: auth    {{ pam_module_control }}    pam_sss.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Enable Smartcards in SSSD - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Enable Smartcards in SSSD - Define a fact for control already filtered in
      case filters are used
    ansible.builtin.set_fact:
      pam_module_control: '[success=done authinfo_unavail=ignore ignore=ignore default=die]'

  - name: Enable Smartcards in SSSD - Check if the required PAM module option is present
      in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: ^\s*auth\s+{{ pam_module_control | regex_escape() }}\s+pam_sss.so\s*.*\stry_cert_auth\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_sssd_enable_smartcards_option_present

  - name: Enable Smartcards in SSSD - Ensure the "try_cert_auth" PAM option for "pam_sss.so"
      is included in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      backrefs: true
      regexp: ^(\s*auth\s+{{ pam_module_control | regex_escape() }}\s+pam_sss.so.*)
      line: \1 try_cert_auth
      state: present
    register: result_pam_sssd_enable_smartcards_add
    when:
    - result_pam_module_sssd_enable_smartcards_option_present.found == 0
  when:
  - '"sssd-common" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - DISA-STIG-OL09-00-000925
  - PCI-DSS-Req-8.3
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_smartcards
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_enable_smartcards:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor" severity="medium">
            <xccdf-1.2:title>SSSD Has a Correct Trust Anchor</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD must have acceptable trust anchor present.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Automatic remediation of this control is not available.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004068</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000185</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5 (2) (a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000066-GPOS-00034</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000384-GPOS-00167</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000900</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271604r1091524_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without path validation, an informed trust decision by the relying party cannot be made when
presented with any certificate not already explicitly trusted.

A trust anchor is an authoritative entity represented via a public key and associated data. It
is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC.

When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor;
it can be, for example, a Certification Authority (CA). A certification path starts with the
subject certificate and proceeds through a number of intermediate certificates up to a trusted
root certificate, typically issued by a trusted CA.

This requirement verifies that a certification path to an accepted trust anchor is used for
certificate validation and that the path includes status information. Path validation is
necessary for a relying party to make an informed trust decision when presented with any
certificate not already explicitly trusted. Status information for certification paths includes
certificate revocation lists or online certificate status protocol responses.
Validation of the certificate status information is out of scope for this requirement.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_has_trust_anchor_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" severity="medium">
            <xccdf-1.2:title>Configure SSSD to Expire Offline Credentials</xccdf-1.2:title>
            <xccdf-1.2:description>SSSD should be configured to expire offline credentials after 1 day.

Check if SSSD allows cached authentications with the following command:
<html:pre>
$ sudo grep cache_credentials /etc/sssd/sssd.conf
cache_credentials = true
</html:pre>
If "cache_credentials" is set to "false" or is missing no further checks are required.<html:br/>

To configure SSSD to expire offline credentials, set
<html:code>offline_credentials_expiration</html:code> to <html:code>1</html:code> under the <html:code>[pam]</html:code>
section in <html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[pam]
offline_credentials_expiration = 1
</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002007</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(13)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000383-GPOS-00166</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000935</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271609r1091539_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If cached authentication information is out-of-date, the validity of the
authentication information may be questionable.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_offline_cred_expiration" complexity="low" disruption="medium" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common; then

# sssd configuration files must be created with 600 permissions if they don't exist
# otherwise the sssd module fails to start
OLD_UMASK=$(umask)
umask u=rw,go=

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[pam\]([^\n\[]*\n+)+?[[:space:]]*offline_credentials_expiration" "$f"; then

            sed -i "s/offline_credentials_expiration[^(\n)]*/offline_credentials_expiration=1/" "$f"

            found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[pam\]" "$f"; then

            sed -i "/[[:space:]]*\[pam\]/a offline_credentials_expiration=1" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[pam]\noffline_credentials_expiration=1" &gt;&gt; "$file"

fi

umask $OLD_UMASK

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_offline_cred_expiration" complexity="low" disruption="medium" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000935
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(13)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_offline_cred_expiration

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  failed_when: false
  changed_when: false
  check_mode: false
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000935
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(13)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_offline_cred_expiration

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
  - section: sssd
    option: domains
    value: default
  - section: domain/default
    option: id_provider
    value: files
  when:
  - '"sssd-common" in ansible_facts.packages'
  - test_grep_domain.stdout is defined
  - test_grep_domain.stdout | length &lt; 1
  tags:
  - DISA-STIG-OL09-00-000935
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(13)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_offline_cred_expiration

- name: Configure SSD to Expire Offline Credentials
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: offline_credentials_expiration
    value: 1
    create: true
    mode: 384
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000935
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(13)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_offline_cred_expiration

- name: Find all the conf files inside /etc/sssd/conf.d/
  find:
    paths: /etc/sssd/conf.d/
    patterns: '*.conf'
  register: sssd_conf_d_files
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000935
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(13)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_offline_cred_expiration

- name: Fix offline_credentials_expiration configuration in /etc/sssd/conf.d/
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: '[^#]*offline_credentials_expiration.*'
    replace: offline_credentials_expiration = 1
  with_items: '{{ sssd_conf_d_files.files }}'
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000935
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(13)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_offline_cred_expiration
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_offline_cred_expiration:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sssd-ldap">
            <xccdf-1.2:title>System Security Services Daemon (SSSD) - LDAP</xccdf-1.2:title>
            <xccdf-1.2:description>The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br/>
       <html:br/>
SSSD can support many backends including LDAP. The <html:code>sssd-ldap</html:code> backend
allows SSSD to fetch identity information from an LDAP server.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="#system_with_kernel"/>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert" severity="medium">
              <xccdf-1.2:title>Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server</xccdf-1.2:title>
              <xccdf-1.2:description>Configure SSSD to demand a valid certificate from the server to
protect the integrity of LDAP remote access sessions by setting
the <html:pre>ldap_tls_reqcert</html:pre> option in <html:pre>/etc/sssd/sssd.conf</html:pre>
to <html:code>demand</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R67</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without a valid certificate presented to the LDAP client backend, the identity of a
server can be forged compromising LDAP remote access sessions.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#sssd-ldap"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_ldap_configure_tls_reqcert"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q sssd-common; then

SSSD_CONF="/etc/sssd/sssd.conf"
LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*ldap_tls_reqcert'
AD_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
DOMAIN_REGEX="[[:space:]]*\[domain\/[^]]*]"

# Check if id_provider is not set to ad (Active Directory) which makes start_tls not applicable, note the -v option to invert the grep.
# Try to find [domain/..] and ldap_tls_reqcert in sssd.conf, if it exists, set to 'demand'
# if ldap_tls_reqcert isn't here, add it
# if [domain/..] doesn't exist, add it here for default domain
if grep -qvzosP $AD_REGEX $SSSD_CONF; then
        if grep -qzosP $LDAP_REGEX $SSSD_CONF; then
                
                sed -i "s#ldap_tls_reqcert[^(\n)]*#ldap_tls_reqcert = demand#" $SSSD_CONF
        elif grep -qs $DOMAIN_REGEX $SSSD_CONF; then
                sed -i "/$DOMAIN_REGEX/a ldap_tls_reqcert = demand" $SSSD_CONF
        else
                if test -f "$SSSD_CONF"; then
                        echo -e "[domain/default]\nldap_tls_reqcert = demand" &gt;&gt; $SSSD_CONF
                else
                        echo "Config file '$SSSD_CONF' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
                fi
        fi
fi

readarray -t SSSD_CONF_D_FILES &lt; &lt;(find /etc/sssd/conf.d/ -name "*.conf")
for SSSD_CONF_D_FILE in "${SSSD_CONF_D_FILES[@]}"; do
    sed -i "s#ldap_tls_reqcert[^(\n)]*#ldap_tls_reqcert = demand#" "$SSSD_CONF_D_FILE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_ldap_configure_tls_reqcert" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy

- name: Test for id_provider different than Active Directory (ad)
  command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
    /etc/sssd/sssd.conf
  register: test_id_provider
  failed_when: false
  changed_when: false
  check_mode: false
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  failed_when: false
  changed_when: false
  check_mode: false
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy

- name: Add default domain group and set ldap_tls_reqcert in sssd configuration (if
    no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    mode: 384
  with_items:
  - section: sssd
    option: domains
    value: default
  - section: domain/default
    option: ldap_tls_reqcert
    value: demand
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - test_grep_domain.stdout is defined
  - test_grep_domain.stdout | length &lt; 1
  - test_id_provider.stdout is defined
  - test_id_provider.stdout | length &lt; 1
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy

- name: Set ldap_tls_reqcert in sssd configuration
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ test_grep_domain.stdout | regex_replace(''\[(.*)\]'',''\1'') }}'
    option: ldap_tls_reqcert
    value: demand
    mode: 384
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - test_grep_domain.stdout is defined
  - test_grep_domain.stdout | length &gt; 0
  - test_id_provider.stdout is defined
  - test_id_provider.stdout | length &lt; 1
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy

- name: Find all the conf files inside /etc/sssd/conf.d/
  find:
    paths: /etc/sssd/conf.d/
    patterns: '*.conf'
  register: sssd_conf_d_files
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy

- name: Set ldap_tls_reqcert to demand in /etc/sssd/conf.d/ if exists
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: '[^#]*ldap_tls_reqcert.*'
    replace: ldap_tls_reqcert = demand
  with_items: '{{ sssd_conf_d_files.files }}'
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12(3)
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_ldap_configure_tls_reqcert
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_ldap_configure_tls_reqcert:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_ldap_configure_tls_reqcert_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls" severity="high">
              <xccdf-1.2:title>Configure SSSD LDAP Backend to Use TLS For All Transactions</xccdf-1.2:title>
              <xccdf-1.2:description>The LDAP client should be configured to implement TLS for the integrity
of all remote LDAP authentication sessions. If the <html:code>id_provider</html:code> is
set to <html:code>ldap</html:code> or <html:code>ipa</html:code> in <html:code>/etc/sssd/sssd.conf</html:code> or any of the
<html:code>/etc/sssd/sssd.conf.d</html:code> configuration files, <html:code>ldap_id_use_start_tls</html:code>
must be set to <html:code>true</html:code>.
<html:br/>
        <html:br/>
To check if LDAP is configured to use TLS when <html:code>id_provider</html:code> is
set to <html:code>ldap</html:code> or <html:code>ipa</html:code>, use the following command:
<html:pre>$ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R67</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without cryptographic integrity protections, information can be
altered by unauthorized users without detection. The ssl directive specifies
whether to use TLS or not. If not specified it will default to no.
It should be set to start_tls rather than doing LDAP over SSL.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#sssd-ldap"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sssd_ldap_start_tls"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; rpm --quiet -q sssd-common; then

SSSD_CONF="/etc/sssd/sssd.conf"
LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*ldap_id_use_start_tls'
AD_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
DOMAIN_REGEX="[[:space:]]*\[domain\/[^]]*]"

# Check if id_provider is not set to ad (Active Directory) which makes start_tls not applicable, note the -v option to invert the grep.
# Try to find [domain/..] and ldap_id_use_start_tls in sssd.conf, if it exists, set to 'true'
# if ldap_id_use_start_tls isn't here, add it
# if [domain/..] doesn't exist, add it here for default domain
if grep -qvzosP $AD_REGEX $SSSD_CONF; then
        if grep -qzosP $LDAP_REGEX $SSSD_CONF; then
                
                sed -i "s#ldap_id_use_start_tls[^(\n)]*#ldap_id_use_start_tls = true#" $SSSD_CONF
        elif grep -qs $DOMAIN_REGEX $SSSD_CONF; then
                sed -i "/$DOMAIN_REGEX/a ldap_id_use_start_tls = true" $SSSD_CONF
        else
                if test -f "$SSSD_CONF"; then
                        echo -e "[domain/default]\nldap_id_use_start_tls = true" &gt;&gt; $SSSD_CONF
                else
                        echo "Config file '$SSSD_CONF' doesnt exist, not remediating, assuming non-applicability." &gt;&amp;2
                fi
        fi
fi

readarray -t SSSD_CONF_D_FILES &lt; &lt;(find /etc/sssd/conf.d/ -name "*.conf")
for SSSD_CONF_D_FILE in "${SSSD_CONF_D_FILES[@]}"; do
    sed -i "s#ldap_id_use_start_tls[^(\n)]*#ldap_id_use_start_tls = true#" "$SSSD_CONF_D_FILE"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="sssd_ldap_start_tls" complexity="low" disruption="medium" reboot="false" strategy="unknown">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy

- name: Test for id_provider different than Active Directory (ad)
  command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
    /etc/sssd/sssd.conf
  register: test_id_provider
  failed_when: false
  changed_when: false
  check_mode: false
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy

- name: Test for domain group
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  failed_when: false
  changed_when: false
  check_mode: false
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy

- name: Add default domain group and set ldap_id_use_start_tls in sssd configuration
    (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    mode: 384
  with_items:
  - section: sssd
    option: domains
    value: default
  - section: domain/default
    option: ldap_id_use_start_tls
    value: 'true'
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - test_grep_domain.stdout is defined
  - test_grep_domain.stdout | length &lt; 1
  - test_id_provider.stdout is defined
  - test_id_provider.stdout | length &lt; 1
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy

- name: Set ldap_id_use_start_tls in sssd configuration
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ test_grep_domain.stdout | regex_replace(''\[(.*)\]'',''\1'') }}'
    option: ldap_id_use_start_tls
    value: 'true'
    mode: 384
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - test_grep_domain.stdout is defined
  - test_grep_domain.stdout | length &gt; 0
  - test_id_provider.stdout is defined
  - test_id_provider.stdout | length &lt; 1
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy

- name: Find all the conf files inside /etc/sssd/conf.d/
  find:
    paths: /etc/sssd/conf.d/
    patterns: '*.conf'
  register: sssd_conf_d_files
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy

- name: Set ldap_id_use_start_tls to true in /etc/sssd/conf.d/ if exists
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: '[^#]*ldap_id_use_start_tls.*'
    replace: ldap_id_use_start_tls = true
  with_items: '{{ sssd_conf_d_files.files }}'
  when:
  - '"sssd-common" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - sssd_ldap_start_tls
  - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-sssd_ldap_start_tls:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-sssd_ldap_start_tls_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_usbguard">
          <xccdf-1.2:title>USBGuard daemon</xccdf-1.2:title>
          <xccdf-1.2:description>The USBGuard daemon enforces the USB device authorization policy for all USB devices.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="#not_s390x_arch_and_system_with_kernel"/>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_usbguard_installed" severity="medium">
            <xccdf-1.2:title>Install usbguard Package</xccdf-1.2:title>
            <xccdf-1.2:description>
The <html:code>usbguard</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install usbguard</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003959</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000141-CTR-000315</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.23.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000320</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271503r1091221_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale><html:code>usbguard</html:code> is a software framework that helps to protect
against rogue USB devices by implementing basic whitelisting/blacklisting
capabilities based on USB device attributes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ( ! ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if ! rpm -q --quiet "usbguard" ; then
    yum install -y "usbguard"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000320
  - NIST-800-53-CM-8(3)
  - NIST-800-53-IA-3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_usbguard_installed

- name: Ensure usbguard is installed
  package:
    name: usbguard
    state: present
  when: ( ansible_architecture != "s390x" and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - DISA-STIG-OL09-00-000320
  - NIST-800-53-CM-8(3)
  - NIST-800-53-IA-3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_usbguard_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_usbguard

class install_usbguard {
  package { 'usbguard':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_usbguard_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=usbguard
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="package_usbguard_installed">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
  extensions:
    - usbguard
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_usbguard_installed">
[[packages]]
name = "usbguard"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_usbguard_installed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" severity="medium">
            <xccdf-1.2:title>Enable the USBGuard Service</xccdf-1.2:title>
            <xccdf-1.2:description>The USBGuard service should be enabled.

The <html:code>usbguard</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable usbguard.service</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003959</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1418</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000141-CTR-000315</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.23.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000321</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271504r1091224_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>usbguard</html:code> service must be running in order to
enforce the USB device authorization policy for all USB devices.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_usbguard_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if ( ! ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'usbguard.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'usbguard.service'
fi
"$SYSTEMCTL_EXEC" enable 'usbguard.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_usbguard_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000321
  - NIST-800-53-CM-8(3)(a)
  - NIST-800-53-IA-3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_usbguard_enabled

- name: Enable the USBGuard Service - Enable service usbguard
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable the USBGuard Service - Enable Service usbguard
    ansible.builtin.systemd:
      name: usbguard
      enabled: true
      state: started
      masked: false
    when:
    - '"usbguard" in ansible_facts.packages'
  when: ( ansible_architecture != "s390x" and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - DISA-STIG-OL09-00-000321
  - NIST-800-53-CM-8(3)(a)
  - NIST-800-53-IA-3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_usbguard_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_usbguard_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_usbguard

class enable_usbguard {
  service {'usbguard':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_usbguard_enabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: usbguard.service
        enabled: true
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_usbguard_enabled">
[customizations.services]
enabled = ["usbguard"]
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_usbguard_enabled:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_usbguard_enabled_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" severity="low">
            <xccdf-1.2:title>Log USBGuard daemon audit events using Linux Audit</xccdf-1.2:title>
            <xccdf-1.2:description>To configure USBGuard daemon to log via Linux Audit
(as opposed directly to a file),
<html:code>AuditBackend</html:code> option in <html:code>/etc/usbguard/usbguard-daemon.conf</html:code>
needs to be set to <html:code>LinuxAudit</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000141-CTR-000315</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002330</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271700r1091812_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Using the Linux Audit logging allows for centralized trace
of events.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="#package_usbguard"/>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="configure_usbguard_auditbackend" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if ( ! ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ) &amp;&amp; { rpm --quiet -q usbguard; }; then

if [ -e "/etc/usbguard/usbguard-daemon.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*AuditBackend=/d" "/etc/usbguard/usbguard-daemon.conf"
else
    touch "/etc/usbguard/usbguard-daemon.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/usbguard/usbguard-daemon.conf"

cp "/etc/usbguard/usbguard-daemon.conf" "/etc/usbguard/usbguard-daemon.conf.bak"
# Insert at the end of the file
printf '%s\n' "AuditBackend=LinuxAudit" &gt;&gt; "/etc/usbguard/usbguard-daemon.conf"
# Clean up after ourselves.
rm "/etc/usbguard/usbguard-daemon.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="configure_usbguard_auditbackend" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002330
  - NIST-800-53-AU-2
  - NIST-800-53-CM-8(3)
  - NIST-800-53-IA-3
  - configure_usbguard_auditbackend
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Log USBGuard daemon audit events using Linux Audit
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/usbguard/usbguard-daemon.conf
      create: true
      regexp: (?i)^\s*AuditBackend=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/usbguard/usbguard-daemon.conf
    lineinfile:
      path: /etc/usbguard/usbguard-daemon.conf
      create: true
      regexp: (?i)^\s*AuditBackend=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/usbguard/usbguard-daemon.conf
    lineinfile:
      path: /etc/usbguard/usbguard-daemon.conf
      create: true
      regexp: (?i)^\s*AuditBackend=
      line: AuditBackend=LinuxAudit
      state: present
  when:
  - ( ansible_architecture != "s390x" and ("kernel" in ansible_facts.packages or "kernel-uek"
    in ansible_facts.packages) )
  - '"usbguard" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002330
  - NIST-800-53-AU-2
  - NIST-800-53-CM-8(3)
  - NIST-800-53-IA-3
  - configure_usbguard_auditbackend
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="configure_usbguard_auditbackend">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
    complianceascode.io/ocp-version: '&gt;=4.7.0'
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %0A%23%0A%23%20Rule%20set%20file%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20file%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%0A%23%0A%23%20RuleFile%3D/path/to/rules.conf%0A%23%0ARuleFile%3D/etc/usbguard/rules.conf%0A%0A%23%0A%23%20Rule%20set%20folder%20path.%0A%23%0A%23%20The%20USBGuard%20daemon%20will%20use%20this%20folder%20to%20load%20the%20policy%0A%23%20rule%20set%20from%20it%20and%20to%20write%20new%20rules%20received%20via%20the%0A%23%20IPC%20interface.%20Usually%2C%20we%20set%20the%20option%20to%0A%23%20/etc/usbguard/rules.d/.%20The%20USBGuard%20daemon%20is%20supposed%20to%0A%23%20behave%20like%20any%20other%20standard%20Linux%20daemon%20therefore%20it%0A%23%20loads%20rule%20files%20in%20alpha-numeric%20order.%20File%20names%20inside%0A%23%20RuleFolder%20directory%20should%20start%20with%20a%20two-digit%20number%0A%23%20prefix%20indicating%20the%20position%2C%20in%20which%20the%20rules%20are%0A%23%20scanned%20by%20the%20daemon.%0A%23%0A%23%20RuleFolder%3D/path/to/rulesfolder/%0A%23%0ARuleFolder%3D/etc/usbguard/rules.d/%0A%0A%23%0A%23%20Implicit%20policy%20target.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20don%27t%20match%20any%20rule%20in%20the%0A%23%20policy.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20-%20authorize%20the%20device%0A%23%20%2A%20block%20%20-%20block%20the%20device%0A%23%20%2A%20reject%20-%20remove%20the%20device%0A%23%0AImplicitPolicyTarget%3Dblock%0A%0A%23%0A%23%20Present%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20devices%20that%20are%20already%20connected%20when%20the%0A%23%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Present%20controller%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20controllers%20that%20are%20already%20connected%0A%23%20when%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20allow%20%20%20%20%20%20%20%20-%20authorize%20every%20present%20device%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20just%20sync%20the%20internal%20state%20and%20leave%20it%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0APresentControllerPolicy%3Dkeep%0A%0A%23%0A%23%20Inserted%20device%20policy.%0A%23%0A%23%20How%20to%20treat%20USB%20devices%20that%20are%20already%20connected%0A%23%20%2Aafter%2A%20the%20daemon%20starts.%20One%20of%3A%0A%23%0A%23%20%2A%20block%20%20%20%20%20%20%20%20-%20deauthorize%20every%20present%20device%0A%23%20%2A%20reject%20%20%20%20%20%20%20-%20remove%20every%20present%20device%0A%23%20%2A%20apply-policy%20-%20evaluate%20the%20ruleset%20for%20every%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20device%0A%23%0AInsertedDevicePolicy%3Dapply-policy%0A%0A%23%0A%23%20Control%20which%20devices%20are%20authorized%20by%20default.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20the%20default%20authorization%20state%20attributes%0A%23%20of%20controller%20devices.%20This%20setting%2C%20enables%20you%20to%20define%20what%20value%20the%0A%23%20default%20authorization%20is%20set%20to.%0A%23%0A%23%20%2A%20keep%20%20%20%20%20%20%20%20%20-%20do%20not%20change%20the%20authorization%20state%0A%23%20%2A%20none%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20deauthorized%0A%23%20%2A%20all%20%20%20%20%20%20%20%20%20%20-%20every%20new%20device%20starts%20out%20authorized%0A%23%20%2A%20internal%20%20%20%20%20-%20internal%20devices%20start%20out%20authorized%2C%20external%20devices%20start%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20out%20deauthorized%20%28this%20requires%20the%20ACPI%20tables%20to%20properly%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20label%20internal%20devices%2C%20and%20kernel%20support%29%0A%23%0A%23AuthorizedDefault%3Dnone%0A%0A%23%0A%23%20Restore%20controller%20device%20state.%0A%23%0A%23%20The%20USBGuard%20daemon%20modifies%20some%20attributes%20of%20controller%0A%23%20devices%20like%20the%20default%20authorization%20state%20of%20new%20child%20device%0A%23%20instances.%20Using%20this%20setting%2C%20you%20can%20control%20whether%20the%0A%23%20daemon%20will%20try%20to%20restore%20the%20attribute%20values%20to%20the%20state%0A%23%20before%20modification%20on%20shutdown.%0A%23%0A%23%20SECURITY%20CONSIDERATIONS%3A%20If%20set%20to%20true%2C%20the%20USB%20authorization%0A%23%20policy%20could%20be%20bypassed%20by%20performing%20some%20sort%20of%20attack%20on%20the%0A%23%20daemon%20%28via%20a%20local%20exploit%20or%20via%20a%20USB%20device%29%20to%20make%20it%20shutdown%0A%23%20and%20restore%20to%20the%20operating-system%20default%20state%20%28known%20to%20be%20permissive%29.%0A%23%0ARestoreControllerDeviceState%3Dfalse%0A%0A%23%0A%23%20Device%20manager%20backend%0A%23%0A%23%20Which%20device%20manager%20backend%20implementation%20to%20use.%20One%20of%3A%0A%23%0A%23%20%2A%20uevent%20%20%20-%20Netlink%20based%20implementation%20which%20uses%20sysfs%20to%20scan%20for%20present%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20devices%20and%20an%20uevent%20netlink%20socket%20for%20receiving%20USB%20device%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20related%20events.%0A%23%20%2A%20umockdev%20-%20umockdev%20based%20device%20manager%20capable%20of%20simulating%20devices%20based%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20on%20umockdev-record%20files.%20Useful%20for%20testing.%0A%23%0ADeviceManagerBackend%3Duevent%0A%0A%23%21%21%21%20WARNING%3A%20It%27s%20good%20practice%20to%20set%20at%20least%20one%20of%20the%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20two%20options%20bellow.%20If%20none%20of%20them%20are%20set%2C%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20the%20daemon%20will%20accept%20IPC%20connections%20from%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20anyone%2C%20thus%20allowing%20anyone%20to%20modify%20the%20%20%20%20%21%21%21%0A%23%21%21%21%20%20%20%20%20%20%20%20%20%20rule%20set%20and%20%28de%29authorize%20USB%20devices.%20%20%20%20%20%20%20%21%21%21%0A%0A%23%0A%23%20Users%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20usernames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedUsers%3Dusername1%20username2%20...%0A%23%0AIPCAllowedUsers%3Droot%0A%0A%23%0A%23%20Groups%20allowed%20to%20use%20the%20IPC%20interface.%0A%23%0A%23%20A%20space%20delimited%20list%20of%20groupnames%20that%20the%20daemon%20will%0A%23%20accept%20IPC%20connections%20from.%0A%23%0A%23%20IPCAllowedGroups%3Dgroupname1%20groupname2%20...%0A%23%0AIPCAllowedGroups%3Dwheel%0A%0A%23%0A%23%20IPC%20access%20control%20definition%20files%20path.%0A%23%0A%23%20The%20files%20at%20this%20location%20will%20be%20interpreted%20by%20the%20daemon%0A%23%20as%20access%20control%20definition%20files.%20The%20%28base%29name%20of%20a%20file%0A%23%20should%20be%20in%20the%20form%3A%0A%23%0A%23%20%20%20%5Buser%5D%5B%3A%3Cgroup%3E%5D%0A%23%0A%23%20and%20should%20contain%20lines%20in%20the%20form%3A%0A%23%0A%23%20%20%20%3Csection%3E%3D%5Bprivilege%5D%20...%0A%23%0A%23%20This%20way%20each%20file%20defines%20who%20is%20able%20to%20connect%20to%20the%20IPC%0A%23%20bus%20and%20what%20privileges%20he%20has.%0A%23%0AIPCAccessControlFiles%3D/etc/usbguard/IPCAccessControl.d/%0A%0A%23%0A%23%20Generate%20device%20specific%20rules%20including%20the%20%22via-port%22%0A%23%20attribute.%0A%23%0A%23%20This%20option%20modifies%20the%20behavior%20of%20the%20allowDevice%0A%23%20action.%20When%20instructed%20to%20generate%20a%20permanent%20rule%2C%0A%23%20the%20action%20can%20generate%20a%20port%20specific%20rule.%20Because%0A%23%20some%20systems%20have%20unstable%20port%20numbering%2C%20the%20generated%0A%23%20rule%20might%20not%20match%20the%20device%20after%20rebooting%20the%20system.%0A%23%0A%23%20If%20set%20to%20false%2C%20the%20generated%20rule%20will%20still%20contain%0A%23%20the%20%22parent-hash%22%20attribute%20which%20also%20defines%20an%20association%0A%23%20to%20the%20parent%20device.%20See%20usbguard-rules.conf%285%29%20for%20more%0A%23%20details.%0A%23%0ADeviceRulesWithPort%3Dfalse%0A%0A%23%0A%23%20USBGuard%20Audit%20events%20log%20backend%0A%23%0A%23%20One%20of%3A%0A%23%0A%23%20%2A%20FileAudit%20-%20Log%20audit%20events%20into%20a%20file%20specified%20by%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20AuditFilePath%20setting%20%28see%20below%29%0A%23%20%2A%20LinuxAudit%20-%20Log%20audit%20events%20using%20the%20Linux%20Audit%0A%23%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20subsystem%20%28using%20audit_log_user_message%29%0A%23%0AAuditBackend%3DLinuxAudit%0A%0A%23%0A%23%20USBGuard%20audit%20events%20log%20file%20path.%0A%23%0A%23AuditFilePath%3D/var/log/usbguard/usbguard-audit.log%0A%0A%23%0A%23%20Hides%20personally%20identifiable%20information%20such%20as%20device%20serial%20numbers%20and%0A%23%20hashes%20of%20descriptors%20%28which%20include%20the%20serial%20number%29%20from%20audit%20entries.%0A%23%0A%23HidePII%3Dfalse }}
        mode: 0600
        path: /etc/usbguard/usbguard-daemon.conf
        overwrite: true
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-configure_usbguard_auditbackend:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-configure_usbguard_auditbackend_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" severity="medium">
            <xccdf-1.2:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</xccdf-1.2:title>
            <xccdf-1.2:description>To allow authorization of USB devices combining human interface device and hub capabilities
by USBGuard daemon,
add the line
<html:code>allow with-interface match-all { 03:*:* 09:00:* }</html:code>
to <html:code>/etc/usbguard/rules.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices and hubs are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices and hubs are allowed. This assumes that an administrator modified the file with some purpose in mind.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000092-CTR-000165</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without allowing Human Interface Devices, it might not be possible
to interact with the system. Without allowing hubs, it might not be possible to use any
USB devices on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="usbguard_allow_hid_and_hub"># Remediation is applicable only in certain platforms
if ( ! ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

echo "allow with-interface match-all { 03:*:* 09:00:* }" &gt;&gt; /etc/usbguard/rules.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="usbguard_allow_hid_and_hub" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-8(3)
  - NIST-800-53-IA-3
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - usbguard_allow_hid_and_hub

- name: Allow HID devices and hubs
  lineinfile:
    path: /etc/usbguard/rules.conf
    create: true
    regexp: ''
    line: allow with-interface match-all { 03:*:* 09:00:* }
    state: present
  when: ( ansible_architecture != "s390x" and ("kernel" in ansible_facts.packages
    or "kernel-uek" in ansible_facts.packages) )
  tags:
  - NIST-800-53-CM-8(3)
  - NIST-800-53-IA-3
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - usbguard_allow_hid_and_hub
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="usbguard_allow_hid_and_hub">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  annotations:
    complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,{{ %0Aallow%20with-interface%20match-all%20%7B%2003%3A%2A%3A%2A%2009%3A00%3A%2A%20%7D }}
        mode: 0600
        path: /etc/usbguard/rules.d/75-hid-and-hub.conf
        overwrite: true
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-usbguard_allow_hid_and_hub:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-usbguard_allow_hid_and_hub_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_usbguard_generate_policy" severity="medium">
            <xccdf-1.2:title>Generate USBGuard Policy</xccdf-1.2:title>
            <xccdf-1.2:description>By default USBGuard when enabled prevents access to all USB devices and this lead
to inaccessible system if they use USB mouse/keyboard. To prevent this scenario,
the initial policy configuration must be generated based on current connected USB
devices.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001958</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-8(3)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.23.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-002331</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271701r1091815_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The <html:code>usbguard</html:code> must be configured to allow connected USB devices to work
properly, avoiding the system to become inaccessible.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="usbguard_generate_policy" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if ( ! ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek ); then

if rpm --quiet -q usbguard
then
    USBGUARD_CONF=/etc/usbguard/rules.conf
    if [ ! -f "$USBGUARD_CONF" ] || [ ! -s "$USBGUARD_CONF" ]; then
        usbguard generate-policy &gt; $USBGUARD_CONF
        if [ ! -s "$USBGUARD_CONF" ]; then
            # make sure OVAL check doesn't fail on systems where
            # generate-policy doesn't find any USB devices (for
            # example a system might not have a USB bus)
            echo "# No USB devices found" &gt; $USBGUARD_CONF
        fi
        # make sure it has correct permissions
        chmod 600 $USBGUARD_CONF

        SYSTEMCTL_EXEC='/usr/bin/systemctl'
        "$SYSTEMCTL_EXEC" unmask 'usbguard.service'
        "$SYSTEMCTL_EXEC" restart 'usbguard.service'
        "$SYSTEMCTL_EXEC" enable 'usbguard.service'
    fi
else
    echo "USBGuard is not installed. No remediation was applied!"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="usbguard_generate_policy" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-002331
  - NIST-800-53-CM-8(3)(a)
  - NIST-800-53-IA-3
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - usbguard_generate_policy

- name: Generate USBGuard Policy
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Check that the /etc/usbguard/rules.conf exists
    stat:
      path: /etc/usbguard/rules.conf
    register: policy_file

  - name: Create USBGuard Policy configuration
    command: usbguard generate-policy
    register: policy
    when: not policy_file.stat.exists or policy_file.stat.size == 0

  - name: Copy the Generated Policy configuration to a persistent file
    copy:
      content: '{{ policy.stdout }}'
      dest: /etc/usbguard/rules.conf
      mode: 384
    when: not policy_file.stat.exists or policy_file.stat.size == 0

  - name: Add comment into /etc/usbguard/rules.conf when system has no USB devices
    lineinfile:
      path: /etc/usbguard/rules.conf
      line: '# No USB devices found'
      state: present
    when: not policy_file.stat.exists or policy_file.stat.size == 0

  - name: Enable service usbguard
    systemd:
      name: usbguard
      enabled: 'yes'
      state: started
      masked: 'no'
  when:
  - ( ansible_architecture != "s390x" and ("kernel" in ansible_facts.packages or "kernel-uek"
    in ansible_facts.packages) )
  - '"usbguard" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-002331
  - NIST-800-53-CM-8(3)(a)
  - NIST-800-53-IA-3
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - usbguard_generate_policy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-usbguard_generate_policy:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-usbguard_generate_policy_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_xwindows">
          <xccdf-1.2:title>X Window System</xccdf-1.2:title>
          <xccdf-1.2:description>The X Window System implementation included with the
system is called X.org.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_xwindows">
            <xccdf-1.2:title>Disable X Windows</xccdf-1.2:title>
            <xccdf-1.2:description>Unless there is a mission-critical reason for the
system to run a graphical user interface, ensure X is not set to start
automatically at boot and remove the X Windows software packages.
There is usually no reason to run X Windows
on a dedicated server system, as it increases the system's attack surface and consumes
system resources. Administrators of server systems should instead login via
SSH or on the text console.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" severity="medium">
              <xccdf-1.2:title>Remove the X Windows Package Group</xccdf-1.2:title>
              <xccdf-1.2:description>By removing the xorg-x11-server-common package, the system no longer has X Windows
installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code>graphical.target</html:code>
mode. To do so, run the following command:<html:pre>$ sudo yum groupremove base-x</html:pre>
        <html:pre>$ sudo yum remove xorg-x11-server-common</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
which might bring your system to an inconsistent state requiring additional configuration to access the system
again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before
continuing installation.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
vulnerabilities and should not be installed unless approved and documented.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
# CAUTION: This remediation script will remove xorg-x11-server-common
#	   from the system, and may remove any packages
#	   that depend on xorg-x11-server-common. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "xorg-x11-server-common" ; then
yum remove -y "xorg-x11-server-common"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">- name: Ensure xorg-x11-server-common is removed
  package:
    name: xorg-x11-server-common
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_xorg-x11-server-common_removed
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">include remove_xorg-x11-server-common

class remove_xorg-x11-server-common {
  package { 'xorg-x11-server-common':
    ensure =&gt; 'purged',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_xorg-x11-server-common_removed" complexity="low" disruption="low" reboot="false" strategy="disable">
package --remove=xorg-x11-server-common
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_xorg-x11-server-common_removed:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_xwindows_remove_packages" severity="medium">
              <xccdf-1.2:title>Disable graphical user interface</xccdf-1.2:title>
              <xccdf-1.2:description>By removing the following packages,  the system no longer has X Windows installed.

<html:code>xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</html:code>

If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code>graphical.target</html:code>
mode. To do so, run the following command:

<html:pre>sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="functionality">The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
which might bring your system to an inconsistent state requiring additional configuration to access the system
again.
The rule <html:code>xwindows_runlevel_target</html:code> can be used to configure the system to boot into the multi-user.target.
If a GUI is an operational requirement, a tailored profile that removes this rule should be used before
continuing installation.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000145</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271465r1091107_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
vulnerabilities and should not be installed unless approved and documented.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="xwindows_remove_packages" complexity="low" disruption="low" reboot="true" strategy="restrict">

# remove packages
if rpm -q --quiet "xorg-x11-server-Xorg" ; then
yum remove -y "xorg-x11-server-Xorg"
fi
if rpm -q --quiet "xorg-x11-server-utils" ; then
yum remove -y "xorg-x11-server-utils"
fi
if rpm -q --quiet "xorg-x11-server-common" ; then
yum remove -y "xorg-x11-server-common"
fi

if rpm -q --quiet "xorg-x11-server-Xwayland" ; then
yum remove -y "xorg-x11-server-Xwayland"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="xwindows_remove_packages" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Ensure xorg packages are removed
  package:
    name:
    - xorg-x11-server-Xorg
    - xorg-x11-server-common
    - xorg-x11-server-utils
    - xorg-x11-server-Xwayland
    state: absent
  tags:
  - DISA-STIG-OL09-00-000145
  - NIST-800-53-CM-6(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - xwindows_remove_packages
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="xwindows_remove_packages">
package --remove=xorg-x11-server-Xorg --remove=xorg-x11-server-common --remove=xorg-x11-server-utils --remove=xorg-x11-server-Xwayland
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-xwindows_remove_packages:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-xwindows_remove_packages_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_xwindows_runlevel_target" severity="medium">
              <xccdf-1.2:title>Disable Graphical Environment Startup By Setting Default Target</xccdf-1.2:title>
              <xccdf-1.2:description>Systems that do not require a graphical user interface should only boot by
default into <html:code>multi-user.target</html:code> mode. This prevents accidental booting of the system
into a <html:code>graphical.target</html:code> mode. Setting the system's default target to
<html:code>multi-user.target</html:code> will prevent automatic startup of the graphical environment.
To do so, run:
<html:pre>$ systemctl set-default multi-user.target</html:pre>
You should see the following output:
<html:pre>Removed symlink /etc/systemd/system/default.target.
Created symlink from /etc/systemd/system/default.target to /usr/lib/systemd/system/multi-user.target.</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271440r1092462_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Services that are not required for system and application processes
must not be active to decrease the attack surface of the system.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#system_with_kernel"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="xwindows_runlevel_target" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

systemctl set-default multi-user.target

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="xwindows_runlevel_target" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000020
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - xwindows_runlevel_target

- name: Switch to multi-user runlevel
  file:
    src: /usr/lib/systemd/system/multi-user.target
    dest: /etc/systemd/system/default.target
    state: link
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000020
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - xwindows_runlevel_target
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-xwindows_runlevel_target:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-xwindows_runlevel_target_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_auditing">
        <xccdf-1.2:title>System Accounting with auditd</xccdf-1.2:title>
        <xccdf-1.2:description>The audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, <html:code>auditd</html:code> has modest disk space
requirements, and should not noticeably impact system performance.
<html:br/>
     <html:br/>
NOTE: The Linux Audit daemon <html:code>auditd</html:code> can be configured to use
the <html:code>augenrules</html:code> program to read audit rules files (<html:code>*.rules</html:code>)
located in <html:code>/etc/audit/rules.d</html:code> location and compile them to create
the resulting form of the <html:code>/etc/audit/audit.rules</html:code> configuration file
during the daemon startup (default configuration). Alternatively, the <html:code>auditd</html:code>
daemon can use the <html:code>auditctl</html:code> utility to read audit rules from the
<html:code>/etc/audit/audit.rules</html:code> configuration file during daemon startup,
and load them into the kernel. The expected behavior is configured via the
appropriate <html:code>ExecStartPost</html:code> directive setting in the
<html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
To instruct the <html:code>auditd</html:code> daemon to use the <html:code>augenrules</html:code> program
to read audit rules (default configuration), use the following setting:
<html:br/>
     <html:pre>ExecStartPost=-/sbin/augenrules --load</html:pre>
in the <html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
In order to instruct the <html:code>auditd</html:code> daemon to use the <html:code>auditctl</html:code>
utility to read audit rules, use the following setting:
<html:br/>
     <html:pre>ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules</html:pre>
in the <html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
Refer to <html:code>[Service]</html:code> section of the <html:code>/usr/lib/systemd/system/auditd.service</html:code>
configuration file for further details.
<html:br/>
     <html:br/>
Government networks often have substantial auditing
requirements and <html:code>auditd</html:code> can be configured to meet these
requirements.
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Red Hat Enterprise Linux 7 Documentation available at
<html:code><html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages</html:a></html:code>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
denial (and the associated system call) that occurred when the Apache HTTP
Server attempted to access the <html:code>/var/www/html/file1</html:code> file (labeled with
the <html:code>samba_share_t</html:code> type):
<html:pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</html:pre>
     <html:ul><html:li><html:code>msg=audit(1226874073.147:96)</html:code><html:ul><html:li>The number in parentheses is the unformatted time stamp (Epoch time)
for the event, which can be converted to standard time by using the
<html:code>date</html:code> command.
</html:li></html:ul></html:li><html:li><html:code>{ getattr }</html:code><html:ul><html:li>The item in braces indicates the permission that was denied. <html:code>getattr</html:code>
indicates the source process was trying to read the target file's status information.
This occurs before reading files. This action is denied due to the file being
accessed having the wrong label. Commonly seen permissions include <html:code>getattr</html:code>,
<html:code>read</html:code>, and <html:code>write</html:code>.</html:li></html:ul></html:li><html:li><html:code>comm="httpd"</html:code><html:ul><html:li>The executable that launched the process. The full path of the executable is
found in the <html:code>exe=</html:code> section of the system call (<html:code>SYSCALL</html:code>) message,
which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul></html:li><html:li><html:code>path="/var/www/html/file1"</html:code><html:ul><html:li>The path to the object (target) the process attempted to access.
</html:li></html:ul></html:li><html:li><html:code>scontext="unconfined_u:system_r:httpd_t:s0"</html:code><html:ul><html:li>The SELinux context of the process that attempted the denied action. In
this case, it is the SELinux context of the Apache HTTP Server, which is running
in the <html:code>httpd_t</html:code> domain.
</html:li></html:ul></html:li><html:li><html:code>tcontext="unconfined_u:object_r:samba_share_t:s0"</html:code><html:ul><html:li>The SELinux context of the object (target) the process attempted to access.
In this case, it is the SELinux context of <html:code>file1</html:code>. Note: the <html:code>samba_share_t</html:code>
type is not accessible to processes running in the <html:code>httpd_t</html:code> domain.</html:li></html:ul></html:li><html:li> From the system call (<html:code>SYSCALL</html:code>) message, two items are of interest:
<html:ul><html:li><html:code>success=no</html:code>: indicates whether the denial (AVC) was enforced or not.
<html:code>success=no</html:code> indicates the system call was not successful (SELinux denied
access). <html:code>success=yes</html:code> indicates the system call was successful - this can
be seen for permissive domains or unconfined domains, such as <html:code>initrc_t</html:code>
and <html:code>kernel_t</html:code>.
</html:li><html:li><html:code>exe="/usr/sbin/httpd"</html:code>: the full path to the executable that launched
the process, which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul>
      </html:li></html:ul>
    </xccdf-1.2:description>
        <xccdf-1.2:platform idref="#system_with_kernel"/>
        <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" severity="medium">
          <xccdf-1.2:title>Install audispd-plugins Package</xccdf-1.2:title>
          <xccdf-1.2:description>The <html:code>audispd-plugins</html:code> package can be installed with the following command:
<html:pre>
$ sudo yum install audispd-plugins</html:pre>
     </xccdf-1.2:description>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000450</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271521r1091275_rule</xccdf-1.2:reference>
          <xccdf-1.2:rationale><html:code>audispd-plugins</html:code> provides plugins for the real-time interface to the
audit subsystem, <html:code>audispd</html:code>. These plugins can do things like relay events
to remote machines or analyze events for suspicious behavior.</xccdf-1.2:rationale>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "audispd-plugins" ; then
    yum install -y "audispd-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000450
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_audispd-plugins_installed

- name: Ensure audispd-plugins is installed
  package:
    name: audispd-plugins
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000450
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.3
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_audispd-plugins_installed
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audispd-plugins

class install_audispd-plugins {
  package { 'audispd-plugins':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_audispd-plugins_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=audispd-plugins
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_audispd-plugins_installed">
[[packages]]
name = "audispd-plugins"
version = "*"
</xccdf-1.2:fix>
          <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_audispd-plugins_installed:def:1"/>
          </xccdf-1.2:check>
          <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
            <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1"/>
          </xccdf-1.2:check>
        </xccdf-1.2:Rule>
        <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_package_audit_installed" severity="medium">
          <xccdf-1.2:title>Ensure the audit Subsystem is Installed</xccdf-1.2:title>
          <xccdf-1.2:description>The audit package should be installed.</xccdf-1.2:description>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000133</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001881</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001875</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000154</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001882</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000158</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001914</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001878</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001877</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001889</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003938</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000132</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000134</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000131</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001879</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001880</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001876</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000159</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(1)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(2)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(2)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000440</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271519r1091269_rule</xccdf-1.2:reference>
          <xccdf-1.2:rationale>The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.</xccdf-1.2:rationale>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if ! rpm -q --quiet "audit" ; then
    yum install -y "audit"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000440
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AU-12(2)
  - NIST-800-53-AU-14
  - NIST-800-53-AU-2(a)
  - NIST-800-53-AU-7(1)
  - NIST-800-53-AU-7(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_audit_installed

- name: Ensure audit is installed
  package:
    name: audit
    state: present
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000440
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AU-12(2)
  - NIST-800-53-AU-14
  - NIST-800-53-AU-2(a)
  - NIST-800-53-AU-7(1)
  - NIST-800-53-AU-7(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_audit_installed
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">include install_audit

class install_audit {
  package { 'audit':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:anaconda:pre" id="package_audit_installed" complexity="low" disruption="low" reboot="false" strategy="enable">
package --add=audit
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="package_audit_installed">
[[packages]]
name = "audit"
version = "*"
</xccdf-1.2:fix>
          <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-package_audit_installed:def:1"/>
          </xccdf-1.2:check>
          <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
            <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-package_audit_installed_ocil:questionnaire:1"/>
          </xccdf-1.2:check>
        </xccdf-1.2:Rule>
        <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_service_auditd_enabled" severity="medium">
          <xccdf-1.2:title>Enable auditd Service</xccdf-1.2:title>
          <xccdf-1.2:description>The <html:code>auditd</html:code> service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
disk.

The <html:code>auditd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable auditd.service</html:pre>
     </xccdf-1.2:description>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000133</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001881</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001875</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000154</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001882</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000158</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001914</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001878</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001877</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001889</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-003938</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000132</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-004188</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000134</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000131</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001879</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001880</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001876</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(g)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(23)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000095-CTR-000170</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000409-CTR-000990</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000508-CTR-001300</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000510-CTR-001310</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000441</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271520r1091272_rule</xccdf-1.2:reference>
          <xccdf-1.2:rationale>Without establishing what type of events occurred, it would be difficult
to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the <html:code>auditd</html:code> service is active ensures audit records
generated by the kernel are appropriately recorded.
<html:br/>
      <html:br/>
Additionally, a properly configured audit subsystem ensures that actions of
individual system users can be uniquely traced to those users so they
can be held accountable for their actions.</xccdf-1.2:rationale>
          <xccdf-1.2:platform idref="#package_audit"/>
          <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_package_audit_installed"/>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q audit; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'auditd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'auditd.service'
fi
"$SYSTEMCTL_EXEC" enable 'auditd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000441
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.2
  - NIST-800-171-3.3.6
  - NIST-800-53-AC-2(g)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-14(1)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(23)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_auditd_enabled

- name: Enable auditd Service - Enable service auditd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable auditd Service - Enable Service auditd
    ansible.builtin.systemd:
      name: auditd
      enabled: true
      state: started
      masked: false
    when:
    - '"audit" in ansible_facts.packages'
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"audit" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000441
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.2
  - NIST-800-171-3.3.6
  - NIST-800-53-AC-2(g)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-14(1)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(23)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_auditd_enabled
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:puppet" id="service_auditd_enabled" complexity="low" disruption="low" reboot="false" strategy="enable">include enable_auditd

class enable_auditd {
  service {'auditd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_auditd_enabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: auditd.service
        enabled: true
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="service_auditd_enabled">
[customizations.services]
enabled = ["auditd"]
</xccdf-1.2:fix>
          <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-service_auditd_enabled:def:1"/>
          </xccdf-1.2:check>
          <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
            <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1"/>
          </xccdf-1.2:check>
        </xccdf-1.2:Rule>
        <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_audit_argument" severity="low">
          <xccdf-1.2:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <html:code>audit=1</html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>audit=1</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>audit=1</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... audit=1 ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="audit=1"</html:pre>
     </xccdf-1.2:description>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IR-5(1)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000750</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271577r1091443_rule</xccdf-1.2:reference>
          <xccdf-1.2:rationale>Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although <html:code>auditd</html:code> takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.</xccdf-1.2:rationale>
          <xccdf-1.2:platform idref="#grub2"/>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_audit_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q grub2-common; }; then

expected_value="1"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "audit" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"audit=[^\"]*\"(.*]\s*)/\1\"audit=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"audit=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-audit.toml"
    fi
else

    grubby --update-kernel=ALL --args=audit=1

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_audit_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000750
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-14(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IR-5(1)
  - PCI-DSS-Req-10.3
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="audit=1"
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000750
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-14(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IR-5(1)
  - PCI-DSS-Req-10.3
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_audit_argument">[customizations.kernel]
append = "audit=1"
</xccdf-1.2:fix>
          <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_audit_argument:def:1"/>
          </xccdf-1.2:check>
          <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
            <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1"/>
          </xccdf-1.2:check>
        </xccdf-1.2:Rule>
        <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" severity="low">
          <xccdf-1.2:title>Extend Audit Backlog Limit for the Audit Daemon</xccdf-1.2:title>
          <xccdf-1.2:description>To improve the kernel capacity to queue all log events, even those which occurred
prior to the audit daemon, add the argument <html:code>audit_backlog_limit=8192</html:code> to the default
GRUB 2 command line for the Linux operating system.
To ensure that <html:code>audit_backlog_limit=8192</html:code> is added as a kernel command line
argument to newly installed kernels, add <html:code>audit_backlog_limit=8192</html:code> to the
default Grub2 command line for Linux operating systems. Modify the line within
<html:code>/etc/default/grub</html:code> as shown below:
<html:pre>GRUB_CMDLINE_LINUX="... audit_backlog_limit=8192 ..."</html:pre>
Run the following command to update command line for already installed kernels:<html:pre># grubby --update-kernel=ALL --args="audit_backlog_limit=8192"</html:pre>
     </xccdf-1.2:description>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
          <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.1</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.3</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7.2</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000830</xccdf-1.2:reference>
          <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271592r1091488_rule</xccdf-1.2:reference>
          <xccdf-1.2:rationale>audit_backlog_limit sets the queue length for audit events awaiting transfer
to the audit daemon. Until the audit daemon is up and running, all log messages
are stored in this queue.  If the queue is overrun during boot process, the action
defined by audit failure flag is taken.</xccdf-1.2:rationale>
          <xccdf-1.2:platform idref="#grub2"/>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="grub2_audit_backlog_limit_argument"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { rpm --quiet -q grub2-common; }; then

expected_value="8192"


if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "audit_backlog_limit" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"audit_backlog_limit=[^\"]*\"(.*]\s*)/\1\"audit_backlog_limit=$expected_value\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"audit_backlog_limit=$expected_value\"]" &gt;&gt; "$KARGS_DIR/10-audit_backlog_limit.toml"
    fi
else

    grubby --update-kernel=ALL --args=audit_backlog_limit=8192

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="grub2_audit_backlog_limit_argument" complexity="medium" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000830
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_backlog_limit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL09-00-000830
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_backlog_limit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
          <xccdf-1.2:fix system="urn:redhat:osbuild:blueprint" id="grub2_audit_backlog_limit_argument">[customizations.kernel]
append = "audit_backlog_limit=8192"
</xccdf-1.2:fix>
          <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-grub2_audit_backlog_limit_argument:def:1"/>
          </xccdf-1.2:check>
          <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
            <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1"/>
          </xccdf-1.2:check>
        </xccdf-1.2:Rule>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_auditd_configure_rules">
          <xccdf-1.2:title>Configure auditd Rules for Comprehensive Auditing</xccdf-1.2:title>
          <xccdf-1.2:description>The <html:code>auditd</html:code> program can perform comprehensive
monitoring of system activity. This section describes recommended
configuration settings for comprehensive auditing, but a full
description of the auditing system's capabilities is beyond the
scope of this guide. The mailing list <html:i>linux-audit@redhat.com</html:i> exists
to facilitate community discussion of the auditing system.
<html:br/>
      <html:br/>
The audit subsystem supports extensive collection of events, including:
<html:br/>
      <html:ul><html:li>Tracing of arbitrary system calls (identified by name or number)
on entry or exit.</html:li><html:li>Filtering by PID, UID, call success, system call argument (with
some limitations), etc.</html:li><html:li>Monitoring of specific files for modifications to the file's
contents or metadata.</html:li></html:ul>
      <html:br/>
Auditing rules at startup are controlled by the file <html:code>/etc/audit/audit.rules</html:code>.
Add rules to it to meet the auditing requirements for your organization.
Each line in <html:code>/etc/audit/audit.rules</html:code> represents a series of arguments
that can be passed to <html:code>auditctl</html:code> and can be individually tested
during runtime. See documentation in <html:code>/usr/share/doc/audit-<html:i>VERSION</html:i>
      </html:code> and
in the related man pages for more details.
<html:br/>
      <html:br/>
If copying any example audit rulesets from <html:code>/usr/share/doc/audit-VERSION</html:code>,
be sure to comment out the
lines containing <html:code>arch=</html:code> which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
<html:br/>
      <html:br/>
After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<html:pre>$ sudo service auditd restart</html:pre>
     </xccdf-1.2:description>
          <xccdf-1.2:platform idref="#package_audit"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audit_failure_mode" type="string" interactive="true">
            <xccdf-1.2:title>Audit failure mode</xccdf-1.2:title>
            <xccdf-1.2:description>This variable is the setting for the -f option in Audit configuration which sets the failure mode of audit.
This option lets you determine how you want the kernel to handle critical errors.
Possible values are: 0=silent, 1=printk, 2=panic.
If the value is set to "2", the system is configured to panic (shut down) in the event of an auditing failure.
If the value is set to "1", the system is configured to only send information to the kernel log regarding the failure.</xccdf-1.2:description>
            <xccdf-1.2:value>2</xccdf-1.2:value>
            <xccdf-1.2:value selector="silent">0</xccdf-1.2:value>
            <xccdf-1.2:value selector="printk">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="panic">2</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_immutable" severity="medium">
            <xccdf-1.2:title>Make the auditd Configuration Immutable</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to make the auditd configuration
immutable:
<html:pre>-e 2</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file in order to make the auditd configuration
immutable:
<html:pre>-e 2</html:pre>
With this setting, a reboot will be required to change any audit rules.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000119-CTR-000245</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000120-CTR-000250</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-008005</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271886r1092370_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Making the audit configuration immutable prevents accidental as
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_immutable"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
#
# files to check if '-e .*' setting is present in that '*.rules' file already.
# If found, delete such occurrence since auditctl(8) manual page instructs the
# '-e 2' rule should be placed as the last rule in the configuration
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-e[[:space:]]\+.*/d' {} ';'

# Append '-e 2' requirement at the end of both:
# * /etc/audit/audit.rules file 		(for auditctl case)
# * /etc/audit/rules.d/immutable.rules		(for augenrules case)

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' &gt;&gt; $AUDIT_FILE
	echo '# Set the audit.rules configuration immutable per security requirements' &gt;&gt; $AUDIT_FILE
	echo '# Reboot is required to change audit rules once this setting is applied' &gt;&gt; $AUDIT_FILE
	echo '-e 2' &gt;&gt; $AUDIT_FILE
	chmod o-rwx $AUDIT_FILE
	chmod g-rwx $AUDIT_FILE
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_immutable" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-008005
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Collect all files from /etc/audit/rules.d with .rules extension
  find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-008005
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Remove the -e option from all Audit config files
  lineinfile:
    path: '{{ item }}'
    regexp: ^\s*(?:-e)\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-008005
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add Audit -e option into /etc/audit/rules.d/immutable.rules and /etc/audit/audit.rules
  lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
    mode: g-rwx,o-rwx
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-008005
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_immutable:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_immutable_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_immutable_login_uids" severity="medium">
            <xccdf-1.2:title>Configure immutable Audit login UIDs</xccdf-1.2:title>
            <xccdf-1.2:description>Configure kernel to prevent modification of login UIDs once they are set.
Changing login UIDs while this configuration is enforced requires special capabilities which
are not available to unprivileged users.
If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to make login UIDs
immutable:
<html:pre>--loginuid-immutable</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file in order to make login UIDs
immutable:
<html:pre>--loginuid-immutable</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-008000</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271885r1092367_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If modification of login UIDs is not prevented, they can be changed by unprivileged users and
make auditing complicated or impossible.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_immutable_login_uids"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# in case auditctl is used
if grep -q '^\s*ExecStartPost=-/sbin/auditctl' /usr/lib/systemd/system/auditd.service; then
  if ! grep -q '^\s*--loginuid-immutable\s*$' /etc/audit/audit.rules; then
    echo "--loginuid-immutable" &gt;&gt; /etc/audit/audit.rules
  fi
else
  immutable_found=0
  while IFS= read -r -d '' f; do
    if grep -q '^\s*--loginuid-immutable\s*$' "$f"; then
      immutable_found=1
    fi
  done &lt;    &lt;(find /etc/audit/rules.d -maxdepth 1 -name '*.rules' -print0)
  if [ $immutable_found -eq 0 ]; then
    echo "--loginuid-immutable" &gt;&gt; /etc/audit/rules.d/immutable.rules
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_immutable_login_uids" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-008000
  - audit_rules_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: 'Configure immutable Audit login UIDs: Determine if rules are loaded by auditctl'
  ansible.builtin.find:
    paths: /usr/lib/systemd/system
    patterns: auditd.service
    contains: ^\s*ExecStartPost=-/sbin/auditctl
  register: auditctl_used
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-008000
  - audit_rules_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: 'Configure immutable Audit login UIDs: Configure immutable login UIDs in /etc/audit/audit.rules'
  ansible.builtin.lineinfile:
    path: /etc/audit/audit.rules
    line: --loginuid-immutable
    regexp: ^\s*--loginuid-immutable\s*$
    mode: '0600'
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - auditctl_used is defined and auditctl_used.matched &gt;= 1
  tags:
  - DISA-STIG-OL09-00-008000
  - audit_rules_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: 'Configure immutable Audit login UIDs: In case Augen-rules is used'
  block:

  - name: 'Configure immutable Audit login UIDs: Detect if immutable login UIDs are
      already defined in /etc/audit/rules.d/*.rules'
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      patterns: '*.rules'
      contains: ^\s*--loginuid-immutable\s*$
    register: immutable_found_in_rules_d

  - name: 'Configure immutable Audit login UIDs: set immutable login UIDS in /etc/audit/rules.d/immutable.rules'
    ansible.builtin.lineinfile:
      path: /etc/audit/rules.d/immutable.rules
      line: --loginuid-immutable
      regexp: ^\s*--loginuid-immutable\s*$
      mode: '0600'
      create: true
    when: immutable_found_in_rules_d is defined and immutable_found_in_rules_d.matched
      == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - auditctl_used is defined and auditctl_used.matched == 0
  tags:
  - DISA-STIG-OL09-00-008000
  - audit_rules_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_immutable_login_uids:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_immutable_login_uids_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" severity="medium">
            <xccdf-1.2:title>Record Events that Modify the System's Mandatory Access Controls</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:

<html:pre>-w /etc/selinux/ -p wa -k MAC-policy</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:

<html:pre>-w /etc/selinux/ -p wa -k MAC-policy</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The system's mandatory access policy (SELinux or Apparmor) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_mac_modification"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/MAC-policy.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/selinux/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/MAC-policy.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/MAC-policy.rules"
    # If the MAC-policy.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_mac_modification" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/MAC-policy.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/selinux/ -p wa -k MAC-policy
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_mac_modification:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification_usr_share" severity="medium">
            <xccdf-1.2:title>Record Events that Modify the System's Mandatory Access Controls in usr/share</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /usr/share/selinux/ -p wa -k MAC-policy</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /usr/share/selinux/ -p wa -k MAC-policy</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_mac_modification_usr_share"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/usr/share/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/usr/share/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/usr/share/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /usr/share/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/MAC-policy.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/usr/share/selinux/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/MAC-policy.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/MAC-policy.rules"
    # If the MAC-policy.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/usr/share/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/usr/share/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/usr/share/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /usr/share/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_mac_modification_usr_share" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /usr/share/selinux/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/usr/share/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/MAC-policy.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /usr/share/selinux/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /usr/share/selinux/ -p wa -k MAC-policy
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /usr/share/selinux/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/usr/share/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /usr/share/selinux/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /usr/share/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_mac_modification_usr_share:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_mac_modification_usr_share_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_media_export" severity="medium">
            <xccdf-1.2:title>Ensure auditd Collects Information on Exporting to Media (successful)</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect media exportation
events for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The unauthorized exportation of data to external media could result in an information leak
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_media_export"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="mount"
	KEY="perm_mod"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_media_export" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit mount tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for mount for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for mount for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_media_export:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" severity="medium">
            <xccdf-1.2:title>Record Events that Modify the System's Network Environment</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification

-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_networkconfig_modification"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="sethostname setdomainname"
	KEY="audit_rules_networkconfig_modification"
	SYSCALL_GROUPING="sethostname setdomainname"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

# Then perform the remediations for the watch rules
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue.net" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/hosts" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sysconfig/network" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_networkconfig_modification" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Remediate audit rules for network configuration for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Remediate audit rules for network configuration for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_networkconfig_modification:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_session_events" severity="medium">
            <xccdf-1.2:title>Record Attempts to Alter Process and Session Initiation Information</xccdf-1.2:title>
            <xccdf-1.2:description>The audit system already collects process information for all
users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000505-CTR-001285</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_session_events"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/utmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/btmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/wtmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_session_events" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/session.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/utmp -p wa -k session
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/utmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/session.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/btmp -p wa -k session
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/btmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/session.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/wtmp -p wa -k session
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/wtmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_session_events:def:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_sudoers" severity="medium">
            <xccdf-1.2:title>Ensure auditd Collects System Administrator Actions - /etc/sudoers</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect administrator actions
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/sudoers -p wa -k actions</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/sudoers -p wa -k actions</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000500</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271527r1092474_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.
Editing the sudoers file may be sign of an attacker trying to
establish persistent methods to a system, auditing the editing of the sudoers
files mitigates this risk.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_sudoers"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_sudoers" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key actions
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)actions$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/actions.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sudoers -p wa -k actions
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000500
  - audit_rules_sudoers
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_sudoers:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_sudoers_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d" severity="medium">
            <xccdf-1.2:title>Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect administrator actions
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/sudoers.d/ -p wa -k actions</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/sudoers.d/ -p wa -k actions</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000505</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271528r1092476_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.
Editing the sudoers file may be sign of an attacker trying to
establish persistent methods to a system, auditing the editing of the sudoers
files mitigates this risk.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_sudoers_d"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers.d/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_sudoers_d" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers.d/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key actions
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)actions$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/actions.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers.d/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers.d/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers.d/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sudoers.d/ -p wa -k actions
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000505
  - audit_rules_sudoers_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_sudoers_d:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_sudoers_d_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function" severity="medium">
            <xccdf-1.2:title>Record Events When Privileged Executables Are Run</xccdf-1.2:title>
            <xccdf-1.2:description>Verify the system generates an audit record when privileged functions are executed.

If audit is using the "auditctl" tool to load the rules, run the following command:

<html:pre>$ sudo grep execve /etc/audit/audit.rules</html:pre>

If audit is using the "augenrules" tool to load the rules, run the following command:

<html:pre>$ sudo grep -r execve /etc/audit/rules.d</html:pre>
       <html:pre>-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid</html:pre>
       <html:pre>-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid</html:pre>
       <html:pre>-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid</html:pre>
       <html:pre>-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid</html:pre>


If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.
If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002233</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002234</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(3)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000326-GPOS-00126</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000343-CTR-000780</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000381-CTR-000905</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000755-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000715</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271570r1092558_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have
compromised information system accounts, is a serious and ongoing concern
and can have significant adverse impacts on organizations. Auditing the use
of privileged functions is one way to detect such misuse and identify the
risk from insider threats and the advanced persistent threat.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_suid_privilege_function"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
    
	OTHER_FILTERS="-C uid!=euid -F euid=0"
	
	AUID_FILTERS=""
	SYSCALL="execve"
	KEY="setuid"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
    
	OTHER_FILTERS="-C gid!=egid -F egid=0"
	
	AUID_FILTERS=""
	SYSCALL="execve"
	KEY="setgid"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_suid_privilege_function" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000715
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(3)
  - NIST-800-53-AU-7(a)
  - NIST-800-53-AU-7(b)
  - NIST-800-53-AU-8(b)
  - NIST-800-53-CM-5(1)
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.2
  - audit_rules_suid_privilege_function
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Service facts
  ansible.builtin.service_facts: null
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000715
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(3)
  - NIST-800-53-AU-7(a)
  - NIST-800-53-AU-7(b)
  - NIST-800-53-AU-8(b)
  - NIST-800-53-CM-5(1)
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.2
  - audit_rules_suid_privilege_function
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set suid_audit_rules fact
  ansible.builtin.set_fact:
    suid_audit_rules:
    - rule: -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
      regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
    - rule: -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
      regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
    - rule: -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
      regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
    - rule: -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
      regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000715
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(3)
  - NIST-800-53-AU-7(a)
  - NIST-800-53-AU-7(b)
  - NIST-800-53-AU-8(b)
  - NIST-800-53-CM-5(1)
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.2
  - audit_rules_suid_privilege_function
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Update /etc/audit/rules.d/privileged.rules to audit privileged functions
  ansible.builtin.lineinfile:
    path: /etc/audit/rules.d/privileged.rules
    line: '{{  item.rule  }}'
    regexp: '{{ item.regex }}'
    mode: '0600'
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ('"auditd.service" in ansible_facts.services' or '"augenrules.service" in ansible_facts.services')
  register: augenrules_audit_rules_privilege_function_update_result
  with_items: '{{ suid_audit_rules }}'
  tags:
  - DISA-STIG-OL09-00-000715
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(3)
  - NIST-800-53-AU-7(a)
  - NIST-800-53-AU-7(b)
  - NIST-800-53-AU-8(b)
  - NIST-800-53-CM-5(1)
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.2
  - audit_rules_suid_privilege_function
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Update /etc/audit/audit.rules to audit privileged functions
  ansible.builtin.lineinfile:
    path: /etc/audit/audit.rules
    line: '{{  item.rule  }}'
    regexp: '{{ item.regex }}'
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ('"auditd.service" in ansible_facts.services' or '"augenrules.service" in ansible_facts.services')
  register: auditctl_audit_rules_privilege_function_update_result
  with_items: '{{ suid_audit_rules }}'
  tags:
  - DISA-STIG-OL09-00-000715
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(3)
  - NIST-800-53-AU-7(a)
  - NIST-800-53-AU-7(b)
  - NIST-800-53-AU-8(b)
  - NIST-800-53-CM-5(1)
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.2
  - audit_rules_suid_privilege_function
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Restart Auditd
  ansible.builtin.command: /usr/sbin/service auditd restart
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (augenrules_audit_rules_privilege_function_update_result.changed or auditctl_audit_rules_privilege_function_update_result.changed)
  - ansible_facts.services["auditd.service"].state == "running"
  tags:
  - DISA-STIG-OL09-00-000715
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(3)
  - NIST-800-53-AU-7(a)
  - NIST-800-53-AU-7(b)
  - NIST-800-53-AU-8(b)
  - NIST-800-53-CM-5(1)
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.2
  - audit_rules_suid_privilege_function
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_suid_privilege_function:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_suid_privilege_function_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" severity="medium">
            <xccdf-1.2:title>Ensure auditd Collects System Administrator Actions</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect administrator actions
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(7)(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5.b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000026-CTR-000070</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000027-CTR-000075</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000028-CTR-000080</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000291-CTR-000675</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000292-CTR-000680</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000293-CTR-000685</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000294-CTR-000690</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000319-CTR-000745</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000320-CTR-000750</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000509-CTR-001305</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_sysadmin_actions"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers.d/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_sysadmin_actions" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sudoers -p wa -k actions
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key actions
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)actions$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/actions.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers.d/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers.d/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sudoers.d/ -p wa -k actions
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/sudoers.d/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key actions
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)actions$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/actions.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/sudoers.d/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_sysadmin_actions:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_system_shutdown" severity="medium">
            <xccdf-1.2:title>Shutdown System When Auditing Failures Occur</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to to the bottom of a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-f <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audit_failure_mode" use="legacy"/>
       </html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to the
bottom of the <html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-f <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audit_failure_mode" use="legacy"/>
       </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-24</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000820</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271590r1091482_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>It is critical for the appropriate personnel to be aware if a system
is at risk of failing to process audit logs as required. Without this
notification, the security personnel may be unaware of an impending failure of
the audit capability, and system operation may be adversely affected.
<html:br/>
       <html:br/>
Audit processing failures include software/hardware errors, failures in the
audit capturing mechanisms, and audit storage capacity being reached or
exceeded.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_system_shutdown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_audit_failure_mode='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audit_failure_mode" use="legacy"/>'


# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-f[[:space:]]\+.*/d' {} ';'

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' &gt;&gt; $AUDIT_FILE
	echo '# Set the audit.rules configuration to halt system upon audit failure per security requirements' &gt;&gt; $AUDIT_FILE
	echo "-f $var_audit_failure_mode" &gt;&gt; $AUDIT_FILE
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_system_shutdown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000820
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.4
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-24
  - audit_rules_system_shutdown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_audit_failure_mode # promote to variable
  set_fact:
    var_audit_failure_mode: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audit_failure_mode" use="legacy"/>
  tags:
    - always

- name: Collect all files from /etc/audit/rules.d with .rules extension
  find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000820
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.4
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-24
  - audit_rules_system_shutdown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Remove the -f option from all Audit config files
  lineinfile:
    path: '{{ item }}'
    regexp: ^\s*(?:-f)\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000820
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.4
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-24
  - audit_rules_system_shutdown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add Audit -f option into /etc/audit/rules.d/immutable.rules and /etc/audit/audit.rules
  lineinfile:
    path: '{{ item }}'
    create: true
    mode: '0600'
    line: -f {{ var_audit_failure_mode }}
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000820
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.4
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-24
  - audit_rules_system_shutdown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_audit_failure_mode:var:1" value-id="xccdf_org.ssgproject.content_value_var_audit_failure_mode"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_system_shutdown:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_system_shutdown_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" severity="medium">
            <xccdf-1.2:title>Record Events that Modify User/Group Information</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
       <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to account changes;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_usergroup_modification_group</html:code></html:li><html:li><html:code>audit_rules_usergroup_modification_gshadow</html:code></html:li><html:li><html:code>audit_rules_usergroup_modification_passwd</html:code></html:li></html:ul>
      </xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000026-CTR-000070</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000027-CTR-000075</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000028-CTR-000080</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000291-CTR-000675</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000292-CTR-000680</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000293-CTR-000685</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000294-CTR-000690</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000319-CTR-000745</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000320-CTR-000750</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000509-CTR-001305</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/group" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/passwd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/gshadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/shadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/security/opasswd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_usergroup_modification:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" severity="medium">
            <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/group</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>
       <html:br/>
       <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000510</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271529r1092478_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_group"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/group" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_group" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/group already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
    for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/group in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/group already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/group in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000510
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_group:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" severity="medium">
            <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/gshadow</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>
       <html:br/>
       <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000515</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271530r1092480_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_gshadow"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/gshadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_gshadow" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/gshadow already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/gshadow\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
    for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/gshadow in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/gshadow already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/gshadow\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/gshadow in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000515
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" severity="medium">
            <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/security/opasswd</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
       <html:br/>
       <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000520</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271531r1092482_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_opasswd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/security/opasswd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_opasswd" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/security/opasswd already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/security/opasswd\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
    for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/security/opasswd in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/security/opasswd already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/security/opasswd\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/security/opasswd in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000520
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" severity="medium">
            <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/passwd</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>
       <html:br/>
       <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000274-GPOS-00104</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000275-GPOS-00105</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000276-GPOS-00106</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000277-GPOS-00107</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000525</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271532r1092484_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_passwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/passwd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_passwd" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/passwd already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/passwd\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
    for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/passwd in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/passwd already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/passwd\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/passwd in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000525
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" severity="medium">
            <xccdf-1.2:title>Record Events that Modify User/Group Information - /etc/shadow</xccdf-1.2:title>
            <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>
       <html:br/>
       <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/>
       <html:br/>
       <html:pre>-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000530</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271533r1092486_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_usergroup_modification_shadow"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/shadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_usergroup_modification_shadow" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/shadow already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/shadow\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
    for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/shadow in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /etc/shadow already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/shadow\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /etc/shadow in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000530
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_sudo_log_events" severity="medium">
            <xccdf-1.2:title>Record Attempts to perform maintenance activities</xccdf-1.2:title>
            <xccdf-1.2:description>The Oracle Linux 9 operating system must generate audit records for
privileged activities, nonlocal maintenance, diagnostic sessions and
other system-level access.

Verify the operating system audits activities performed during nonlocal
maintenance and diagnostic sessions. Run the following command:
<html:pre>$ sudo auditctl -l | grep sudo.log
-w /var/log/sudo.log -p wa -k maintenance</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5.b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If events associated with nonlocal administrative access or diagnostic
sessions are not logged, a major tool for assessing and investigating
attacks would not be available.
This requirement addresses auditing-related issues associated with
maintenance tools used specifically for diagnostic and repair actions
on organizational information systems.
Nonlocal maintenance and diagnostic activities are those activities
conducted by individuals communicating through a network, either an
external network (e.g., the internet) or an internal network. Local
maintenance and diagnostic activities are those activities carried
out by individuals physically present at the information system or
information system component and not communicating across a network
connection.
This requirement applies to hardware/software diagnostic test
equipment or tools. This requirement does not cover hardware/software
components that may support information system maintenance, yet are a
part of the system, for example, the software implementing "ping,"
"ls," "ipconfig," or the hardware and software implementing the
monitoring port of an Ethernet switch.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_sudo_log_events"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'


# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/sudo.log" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/sudo.log $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/sudo.log$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/sudo.log -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/sudo.log" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/sudo.log" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/sudo.log $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/sudo.log$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/sudo.log -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_sudo_log_events" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/sudo.log already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/sudo.log\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key logins
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)logins$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/logins.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/logins.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/sudo.log in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/sudo.log -p wa -k logins
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/sudo.log already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/sudo.log\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/sudo.log in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/sudo.log -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_sudo_log_events:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_sudo_log_events_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" severity="medium">
            <xccdf-1.2:title>Record Access Events to Audit Log Directory</xccdf-1.2:title>
            <xccdf-1.2:description>The audit system should collect access events to read audit log directory.
The following audit rule will assure that access to audit log directory are
collected.
<html:pre>-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
rule to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>.
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the rule to
<html:code>/etc/audit/audit.rules</html:code> file.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Attempts to read the logs should be recorded, suspicious access to audit log files could be an indicator of malicious activity on a system.
Auditing these events could serve as evidence of potential system compromise.'</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_access_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F dir=/var/log/audit/ -F perm=r"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="access-audit-trail"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_access_var_log_audit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - directory_access_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /var/log/audit
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access-audit-trail.rules
    set_fact: audit_file="/etc/audit/rules.d/access-audit-trail.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F dir=/var/log/audit/ -F perm=r -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F dir=/var/log/audit/ -F perm=r
        -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F dir=/var/log/audit/ -F perm=r
        -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - directory_access_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_access_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit" severity="medium">
            <xccdf-1.2:title>System Audit Directories Must Be Group Owned By Root</xccdf-1.2:title>
            <xccdf-1.2:description>All audit directories must be group owned by root user. By default, the path for audit log is <html:pre>/var/log/audit/</html:pre>.

To properly set the group owner of <html:code>/var/log/audit</html:code>, run the command:
<html:pre>$ sudo chgrp root /var/log/audit</html:pre>

If <html:code>log_group</html:code> in <html:code>/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code>root</html:code>
group account, change the group ownership of the audit directories to this specific group.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000785</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271583r1091461_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_group_ownership_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
else
  GROUP=root
fi
if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
  DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)
else
  DIR="/var/log/audit"
fi


find ${DIR} -type d -exec chgrp ${GROUP} {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_group_ownership_var_log_audit" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000785
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - configure_strategy
  - directory_group_ownership_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: System Audit Directories Must Be Group Owned By Root - Register Audit Configuration
    Text
  ansible.builtin.slurp:
    src: /etc/audit/auditd.conf
  register: auditd_config_slurp
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000785
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - configure_strategy
  - directory_group_ownership_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: System Audit Directories Must Be Group Owned By Root - Set Permissions Custom
    Location
  ansible.builtin.file:
    group: |-
      {{ auditd_config_slurp['content'] | b64decode | regex_findall('
      log_group\s*=\s*(.+)') | default(['root',], boolean=True) | first }}
    path: |-
      {{ auditd_config_slurp['content'] | b64decode | regex_findall('
      log_file\s*=\s*(.+)') | default(['/var/log/audit/audit.log',], boolean=True) | first | dirname }}
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000785
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - configure_strategy
  - directory_group_ownership_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_group_ownership_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_group_ownership_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit" severity="medium">
            <xccdf-1.2:title>System Audit Directories Must Be Owned By Root</xccdf-1.2:title>
            <xccdf-1.2:description>All audit directories must be owned by root user. By default, the path for audit log is <html:pre>/var/log/audit/</html:pre>.

To properly set the owner of <html:code>/var/log/audit</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000790</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271584r1091464_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_ownership_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
    LOGPATH="$(dirname "$FILE")"
    chown root $LOGPATH
else
    chown root /var/log/audit
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="directory_ownership_var_log_audit" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000790
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - configure_strategy
  - directory_ownership_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: System Audit Directories Must Be Owned By Root - Register Audit Configuration
    Text
  ansible.builtin.slurp:
    src: /etc/audit/auditd.conf
  register: auditd_config_slurp
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000790
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - configure_strategy
  - directory_ownership_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: System Audit Directories Must Be Owned By Root - Set Permissions Custom Location
  ansible.builtin.file:
    owner: root
    path: |-
      {{ auditd_config_slurp['content'] | b64decode | regex_findall('
      log_file\s*=\s*(.+)') | default(['/var/log/audit/audit.log',], boolean=True) | first | dirname }}
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000790
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - configure_strategy
  - directory_ownership_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_ownership_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_ownership_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" severity="medium">
            <xccdf-1.2:title>System Audit Logs Must Have Mode 0750 or Less Permissive</xccdf-1.2:title>
            <xccdf-1.2:description>
If <html:code>log_group</html:code> in <html:code>/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code>root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0750 /var/log/audit</html:pre>
       <html:br/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0700 /var/log/audit</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL2</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If users can write to audit logs, audit trails can be modified or destroyed.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="directory_permissions_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
  DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)
else
  DIR="/var/log/audit"
fi


if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chmod 0750 $DIR
  else
    chmod 0700 $DIR
  fi
else
  chmod 0700 $DIR
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-directory_permissions_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_group_ownership_var_log_audit" severity="medium">
            <xccdf-1.2:title>System Audit Logs Must Be Group Owned By Root</xccdf-1.2:title>
            <xccdf-1.2:description>All audit logs must be group owned by root user. The path for audit log can
be configured via <html:code>log_file</html:code> parameter in <html:pre>/etc/audit/auditd.conf</html:pre>
or, by default, the path for audit log is <html:pre>/var/log/audit/</html:pre>.

To properly set the group owner of <html:code>/var/log/audit/*</html:code>, run the command:
<html:pre>$ sudo chgrp root /var/log/audit/*</html:pre>

If <html:code>log_group</html:code> in <html:code>/etc/audit/auditd.conf</html:code> is set to a group other
than the <html:code>root</html:code> group account, change the group ownership of the audit logs
to this specific group.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_group_ownership_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
  FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
else
  FILE="/var/log/audit/audit.log"
fi


if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
    if ! [ "${GROUP}" == 'root' ]; then
      chgrp ${GROUP} $FILE*
    else
      chgrp root $FILE*
    fi
else
  chgrp root $FILE*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_group_ownership_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_group_ownership_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration" severity="medium">
            <xccdf-1.2:title>Audit Configuration Files Must Be Owned By Group root</xccdf-1.2:title>
            <xccdf-1.2:description>All audit configuration files must be owned by group root.
<html:pre>chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_groupownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/audit/ -maxdepth 1 -type f ! -group 0 -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chgrp -L 0 {} \;

find -L /etc/audit/rules.d/ -maxdepth 1 -type f ! -group 0 -regextype posix-extended -regex '^.*\.rules$' -exec chgrp -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_groupownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  command: find -H /etc/audit/ -maxdepth 1 -type f ! -group 0 -regextype posix-extended
    -regex "^.*audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -type f ! -group 0 -regextype posix-extended
    -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  file:
    path: '{{ item }}'
    group: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_groupownership_audit_configuration:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration" severity="medium">
            <xccdf-1.2:title>Audit Configuration Files Must Be Owned By Root</xccdf-1.2:title>
            <xccdf-1.2:description>All audit configuration files must be owned by root user.

To properly set the owner of <html:code>/etc/audit/</html:code>, run the command:
<html:pre>$ sudo chown root /etc/audit/ </html:pre>

To properly set the owner of <html:code>/etc/audit/rules.d/</html:code>, run the command:
<html:pre>$ sudo chown root /etc/audit/rules.d/ </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/audit/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chown -L 0 {} \;

find -L /etc/audit/rules.d/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended -regex '^.*\.rules$' -exec chown -L 0 {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_ownership_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  command: find -H /etc/audit/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended
    -regex "^.*audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -type f ! -uid 0 -regextype posix-extended
    -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  file:
    path: '{{ item }}'
    owner: '0'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_ownership_audit_configuration:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_ownership_audit_configuration_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" severity="medium">
            <xccdf-1.2:title>System Audit Logs Must Be Owned By Root</xccdf-1.2:title>
            <xccdf-1.2:description>All audit logs must be owned by root user and group. By default, the path for audit log is <html:pre>/var/log/audit/</html:pre>.

To properly set the owner of <html:code>/var/log/audit</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit </html:pre>

To properly set the owner of <html:code>/var/log/audit/*</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit/* </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000118-CTR-000240</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_ownership_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chown root:${GROUP} /var/log/audit
    chown root:${GROUP} /var/log/audit/audit.log*
  else
    chown root:root /var/log/audit
    chown root:root /var/log/audit/audit.log*
  fi
else
  chown root:root /var/log/audit
  chown root:root /var/log/audit/audit.log*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_ownership_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration" severity="medium">
            <xccdf-1.2:title>Audit Configuration Files Permissions are 640 or More Restrictive</xccdf-1.2:title>
            <xccdf-1.2:description>All audit configuration files permissions must be 640 or more restrictive.
<html:pre>chmod 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12 b</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL4</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/audit/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chmod u-xs,g-xws,o-xwrt {} \;

find -L /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regextype posix-extended -regex '^.*\.rules$' -exec chmod u-xs,g-xws,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_audit_configuration" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/ file(s)
  command: find -H /etc/audit/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regextype
    posix-extended -regex "^.*audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/audit/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s)
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type
    f -regextype posix-extended -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/audit/rules.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_audit_configuration:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_audit_configuration_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" severity="medium">
            <xccdf-1.2:title>System Audit Logs Must Have Mode 0640 or Less Permissive</xccdf-1.2:title>
            <xccdf-1.2:description>
Determine where the audit logs are stored with the following command:
<html:pre>$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log</html:pre>
Configure the audit log to be protected from unauthorized read access by setting the correct
permissive mode with the following command:
<html:pre>$ sudo chmod 0600 <html:i>audit_log_file</html:i>
       </html:pre>
By default, <html:i>audit_log_file</html:i> is "/var/log/audit/audit.log".</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000118-CTR-000240</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000795</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271585r1091467_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If users can write to audit logs, audit trails can be modified or destroyed.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_var_log_audit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
else
    FILE="/var/log/audit/audit.log"
fi


chmod 0600 $FILE

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_var_log_audit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000795
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get audit log files
  command: grep -iw ^log_file /etc/audit/auditd.conf
  failed_when: false
  register: log_file_exists
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000795
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Parse log file line
  command: awk -F '=' '/^log_file/ {print $2}' /etc/audit/auditd.conf
  register: log_file_line
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - log_file_exists is not skipped and (log_file_exists.stdout | length &gt; 0)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000795
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set default log_file if not set
  set_fact:
    log_file: /var/log/audit/audit.log
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (log_file_exists is skipped) or (log_file_exists is undefined) or (log_file_exists.stdout
    | length == 0)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000795
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set log_file from log_file_line if not set already
  set_fact:
    log_file: '{{ log_file_line.stdout | trim }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - (log_file_exists is not skipped) and (log_file_line.stdout is defined) and (log_file_line.stdout
    | length &gt; 0)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000795
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Apply mode to log file
  file:
    path: '{{ log_file }}'
    mode: 384
  failed_when: false
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000795
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_var_log_audit:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_dac_actions">
            <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - chmod</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000640</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271555r1092530_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_chmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_chmod" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chmod for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chmod for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_chmod:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - chown</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000645</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271556r1092532_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_chown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_chown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chown for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chown for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_chown:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000640</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271555r1092530_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchmod" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchmod:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000640</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271555r1092530_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchmodat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmodat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchmodat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000640
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchown</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000645</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271556r1092532_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchown for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchown for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchown:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000645</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271556r1092532_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fchownat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchownat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fchownat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_fchownat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/>
        <html:br/>
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid=0 -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000545</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271536r1092492_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fremovexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fremovexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid=0 -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid=0 -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000545</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271536r1092492_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_fsetxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_fsetxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - lchown</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000645</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271556r1092532_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_lchown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_lchown" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lchown for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lchown for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000645
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_lchown:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/>
        <html:br/>
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid=0 -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000545</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271536r1092492_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_lremovexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_lremovexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid=0 -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid=0 -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000545</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271536r1092492_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_lsetxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_lsetxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/>
        <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following line to a file with suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S removexattr -F auid=0 -F key=perm_mod</html:pre>
        <html:br/>
        <html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S removexattr -F auid=0 -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000545</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271536r1092492_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_removexattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="removexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_removexattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_removexattr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b32 -S setxattr -F auid=0 -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:pre>-a always,exit -F arch=b64 -S setxattr -F auid=0 -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000545</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271536r1092492_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_setxattr"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="setxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_setxattr" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000545
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_setxattr:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - umount</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file system umount
changes. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000840</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271594r1092582_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_umount"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

ACTION_ARCH_FILTERS="-a always,exit -F arch=b32"
OTHER_FILTERS=""
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="umount"
KEY="perm_mod"
SYSCALL_GROUPING=""

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_umount" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000840
  - audit_rules_dac_modification_umount
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for umount for x86 platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - umount
      syscall_grouping: []

  - name: Check existence of umount in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - umount
      syscall_grouping: []

  - name: Check existence of umount in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000840
  - audit_rules_dac_modification_umount
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_umount:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_umount_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2" severity="medium">
              <xccdf-1.2:title>Record Events that Modify the System's Discretionary Access Controls - umount2</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file system umount2
changes. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S umount2 -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000845</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271595r1092584_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_dac_modification_umount2"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="umount2"
	KEY="perm_mod"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_dac_modification_umount2" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000845
  - audit_rules_dac_modification_umount2
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit umount2 tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000845
  - audit_rules_dac_modification_umount2
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for umount2 for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - umount2
      syscall_grouping: []

  - name: Check existence of umount2 in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - umount2
      syscall_grouping: []

  - name: Check existence of umount2 in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000845
  - audit_rules_dac_modification_umount2
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for umount2 for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - umount2
      syscall_grouping: []

  - name: Check existence of umount2 in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - umount2
      syscall_grouping: []

  - name: Check existence of umount2 in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000845
  - audit_rules_dac_modification_umount2
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_dac_modification_umount2:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_dac_modification_umount2_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_execution_acl_commands">
            <xccdf-1.2:title>Record Execution Attempts to Run ACL Privileged Commands</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
ACL privileged commands for all users and root.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run chacl</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>chacl</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000665</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271560r1092540_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.
Audit records can be generated from various components within the
information system (e.g., module or policy filter).</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_chacl"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chacl -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_chacl" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000665
  - audit_rules_execution_chacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chacl
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chacl -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chacl -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chacl -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000665
  - audit_rules_execution_chacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_chacl:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_chacl_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run setfacl</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>setfacl</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000560</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271539r1092498_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.
Audit records can be generated from various components within the
information system (e.g., module or policy filter).</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_setfacl"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/setfacl -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_setfacl" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000560
  - audit_rules_execution_setfacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/setfacl
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/setfacl -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/setfacl -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/setfacl -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000560
  - audit_rules_execution_setfacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_setfacl:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_setfacl_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands">
            <xccdf-1.2:title>Record Execution Attempts to Run SELinux Privileged Commands</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
SELinux privileged commands for all users and root.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run chcon</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>chcon</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000555</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271538r1092496_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_chcon"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chcon -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_chcon" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000555
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_chcon
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chcon
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chcon -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000555
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_chcon
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_chcon:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run restorecon</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>restorecon</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_restorecon"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/restorecon -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_restorecon" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_restorecon
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/restorecon
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/restorecon -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/restorecon
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/restorecon
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_restorecon
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_restorecon:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_restorecon_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run semanage</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>semanage</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000650</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271557r1092534_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_semanage"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/semanage -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_semanage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000650
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_semanage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/semanage
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/semanage -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/semanage -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/semanage -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000650
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_semanage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_semanage:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_semanage_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run setfiles</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>setfiles</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000655</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271558r1092536_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_setfiles"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/setfiles -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_setfiles" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000655
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_setfiles
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/setfiles
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setfiles -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setfiles -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setfiles -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000655
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_setfiles
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_setfiles:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_setfiles_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run setsebool</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>setsebool</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000496-CTR-001240</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000497-CTR-001245</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000498-CTR-001250</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000660</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271559r1092538_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_setsebool"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/setsebool -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_setsebool" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000660
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_setsebool
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/setsebool
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setsebool -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setsebool -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setsebool -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000660
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_setsebool
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_setsebool:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_setsebool_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run seunshare</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>seunshare</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_execution_seunshare"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/seunshare -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_execution_seunshare" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_seunshare
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/seunshare
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/seunshare -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/seunshare -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/seunshare -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_seunshare
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_execution_seunshare:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_execution_seunshare_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_file_deletion_events">
            <xccdf-1.2:title>Record File Deletion Events by User</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to file deletion;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_file_deletion_events_rmdir</html:code></html:li><html:li><html:code>audit_rules_file_deletion_events_unlink</html:code></html:li><html:li><html:code>audit_rules_file_deletion_events_unlinkat</html:code></html:li></html:ul>
       </xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rmdir unlink unlinkat rename renameat"
	KEY="delete"
	SYSCALL_GROUPING="rmdir unlink unlinkat rename renameat"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_file_deletion_events:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - rename</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000680</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271563r1092546_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_rename"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rename"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_rename" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for rename for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rename in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rename in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for rename for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rename in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rename in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_rename:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - renameat</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000680</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271563r1092546_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_renameat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="renameat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_renameat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for renameat for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of renameat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of renameat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for renameat for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of renameat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of renameat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - rmdir</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000680</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271563r1092546_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_rmdir"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rmdir"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_rmdir" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rmdir
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit rmdir tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rmdir
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for rmdir for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rmdir
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rmdir in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rmdir
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rmdir in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rmdir
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for rmdir for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rmdir
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rmdir in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - rmdir
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of rmdir in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rmdir
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - unlink</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000680</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271563r1092546_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_unlink"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlink"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_unlink" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlink for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlink in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlink in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlink for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlink in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlink in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects File Deletion Events by User - unlinkat</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000680</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271563r1092546_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_file_deletion_events_unlinkat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlinkat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_file_deletion_events_unlinkat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000680
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_file_modification">
            <xccdf-1.2:title>Record Unauthorized Access Attempts Events to Files (unsuccessful)</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre>-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to unsuccessful file modification;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_unsuccessful_file_modification_open</html:code></html:li><html:li><html:code>audit_rules_unsuccessful_file_modification_ftruncate</html:code></html:li><html:li><html:code>audit_rules_unsuccessful_file_modification_creat</html:code></html:li></html:ul>
       </xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# Perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

	# First fix the -EACCES requirement
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="creat open openat open_by_handle_at truncate ftruncate"
	KEY="access"
	SYSCALL_GROUPING="creat open openat open_by_handle_at truncate ftruncate"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

	# Then fix the -EPERM requirement
	# No need to change content of $GROUP variable - it's the same as for -EACCES case above
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="creat open openat open_by_handle_at truncate ftruncate"
	KEY="access"
	SYSCALL_GROUPING="creat open openat open_by_handle_at truncate ftruncate"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" severity="medium">
              <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - creat</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000635</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271554r1092528_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_creat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="creat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_creat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit creat tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" severity="medium">
              <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - ftruncate</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000635</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271554r1092528_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_ftruncate"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="ftruncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_ftruncate" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit ftruncate tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" severity="medium">
              <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - open</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000635</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271554r1092528_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_open"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" severity="medium">
              <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000635</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271554r1092528_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_open_by_handle_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open_by_handle_at"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_open_by_handle_at" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open_by_handle_at
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open_by_handle_at
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EACCES for 32bit
    platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open_by_handle_at
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EACCES for 64bit
    platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open_by_handle_at
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open_by_handle_at
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - open_by_handle_at
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open_by_handle_at
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" severity="medium">
              <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - openat</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000635</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271554r1092528_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_openat"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="openat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_openat" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" severity="medium">
              <xccdf-1.2:title>Record Unsuccessful Access Attempts to Files - truncate</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000635</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271554r1092528_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_unsuccessful_file_modification_truncate"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="truncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_unsuccessful_file_modification_truncate" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit truncate tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000635
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_kernel_module_loading">
            <xccdf-1.2:title>Record Information on Kernel Modules Loading and Unloading</xccdf-1.2:title>
            <xccdf-1.2:description>To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,delete_module -F key=modules
</html:pre>

Place to add the lines depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the lines to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</xccdf-1.2:title>
              <xccdf-1.2:description>To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,finit_module,delete_module -F auid&gt;=1000 -F auid!=unset -F key=modules
</html:pre>

The place to add the lines depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the lines to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        OTHER_FILTERS=""
        
        AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
        
        SYSCALL="init_module finit_module delete_module"
        KEY="modules"
        SYSCALL_GROUPING="init_module finit_module delete_module"
        # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
        unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
        unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_kernel_module_loading" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for kernel module loading for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      - delete_module
      - finit_module
      syscall_grouping:
      - init_module
      - delete_module
      - finit_module

  - name: Check existence of init_module, delete_module, finit_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      - delete_module
      - finit_module
      syscall_grouping:
      - init_module
      - delete_module
      - finit_module

  - name: Check existence of init_module, delete_module, finit_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for kernel module loading for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      - delete_module
      - finit_module
      syscall_grouping:
      - init_module
      - delete_module
      - finit_module

  - name: Check existence of init_module, delete_module, finit_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      - delete_module
      - finit_module
      syscall_grouping:
      - init_module
      - delete_module
      - finit_module

  - name: Check existence of init_module, delete_module, finit_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</xccdf-1.2:title>
              <xccdf-1.2:description>To capture kernel module unloading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S delete_module -F auid&gt;=1000 -F auid!=unset -F key=modules</html:pre>


Place to add the line depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the line to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000504-CTR-001280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271564r1092548_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading_delete"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	
	SYSCALL="delete_module"
	KEY="modules"
	SYSCALL_GROUPING="delete_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_kernel_module_loading_delete" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000685
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set architecture for audit delete_module tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000685
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Perform remediation of Audit rules for delete_module for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - delete_module
      syscall_grouping: []

  - name: Check existence of delete_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
    set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - delete_module
      syscall_grouping: []

  - name: Check existence of delete_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000685
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Perform remediation of Audit rules for delete_module for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - delete_module
      syscall_grouping: []

  - name: Check existence of delete_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
    set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - delete_module
      syscall_grouping: []

  - name: Check existence of delete_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000685
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code> program
to read audit rules during daemon startup (the default), add the following lines to a file
with suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code> to capture kernel module
loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F auid&gt;=1000 -F auid!=unset -F key=modules</html:pre>
    If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility to read audit
rules during daemon startup, add the following lines to <html:code>/etc/audit/audit.rules</html:code> file
in order to capture kernel module loading and unloading events, setting ARCH to either b32 or
b64 as appropriate for your system:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F auid&gt;=1000 -F auid!=unset -F key=modules</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000504-CTR-001280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000690</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271565r1092550_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading_finit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	
	SYSCALL="finit_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_kernel_module_loading_finit" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set architecture for audit finit_module tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Perform remediation of Audit rules for finit_module for x86 platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of finit_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
    set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of finit_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Perform remediation of Audit rules for finit_module for x86_64 platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of finit_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
    set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of finit_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading_finit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</xccdf-1.2:title>
              <xccdf-1.2:description>To capture kernel module loading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module -F auid&gt;=1000 -F auid!=unset -F key=modules</html:pre>


Place to add the line depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the line to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000504-CTR-001280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000690</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271565r1092550_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>The addition of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_kernel_module_loading_init"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	
	SYSCALL="init_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_kernel_module_loading_init" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set architecture for audit init_module tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Perform remediation of Audit rules for init_module for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of init_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
    set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of init_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Perform remediation of Audit rules for init_module for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of init_module in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
    set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - init_module
      - finit_module

  - name: Check existence of init_module in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=module-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - DISA-STIG-OL09-00-000690
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_kernel_module_loading_init:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_login_events">
            <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events</xccdf-1.2:title>
            <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to login events;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_login_events_tallylog</html:code></html:li><html:li><html:code>audit_rules_login_events_faillock</html:code></html:li><html:li><html:code>audit_rules_login_events_lastlog</html:code></html:li></html:ul>
       </xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

var_accounts_passwords_pam_faillock_dir='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>'


# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/tallylog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir} $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir}$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w ${var_accounts_passwords_pam_faillock_dir} -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir} $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir}$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w ${var_accounts_passwords_pam_faillock_dir} -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/lastlog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_dir:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_login_events:def:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events - faillock</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000506-CTR-001290</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000720</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271571r1092560_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events_faillock"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'


var_accounts_passwords_pam_faillock_dir='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir} $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir}$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w ${var_accounts_passwords_pam_faillock_dir} -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir} $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir}$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w ${var_accounts_passwords_pam_faillock_dir} -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_login_events_faillock" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_dir # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_dir: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>
  tags:
    - always

- name: Check if watch rule for {{ var_accounts_passwords_pam_faillock_dir }} already
    exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+{{ var_accounts_passwords_pam_faillock_dir }}\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key logins
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)logins$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/logins.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/logins.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for {{ var_accounts_passwords_pam_faillock_dir }} in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w {{ var_accounts_passwords_pam_faillock_dir }} -p wa -k logins
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for {{ var_accounts_passwords_pam_faillock_dir }} already
    exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+{{ var_accounts_passwords_pam_faillock_dir }}\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for {{ var_accounts_passwords_pam_faillock_dir }} in /etc/audit/audit.rules
  lineinfile:
    line: -w {{ var_accounts_passwords_pam_faillock_dir }} -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000720
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_dir:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir"/>
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_login_events_faillock:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events - lastlog</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/lastlog -p wa -k logins</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000506-CTR-001290</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000700</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271567r1092554_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events_lastlog"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'


# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/lastlog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_login_events_lastlog" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/lastlog already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/lastlog\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key logins
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)logins$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/logins.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/logins.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/lastlog in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/lastlog -p wa -k logins
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/lastlog already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/lastlog\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/lastlog in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/lastlog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000700
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_login_events_lastlog:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Logon and Logout Events - tallylog</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000503-CTR-001275</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000725</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271572r1092562_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_login_events_tallylog"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'


# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/tallylog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_login_events_tallylog" complexity="low" disruption="low" reboot="true" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/tallylog already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/tallylog\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key logins
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)logins$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use /etc/audit/rules.d/logins.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/logins.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/tallylog in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/tallylog -p wa -k logins
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Check if watch rule for /var/log/tallylog already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/tallylog\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Add watch rule for /var/log/tallylog in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/tallylog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - DISA-STIG-OL09-00-000725
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_tallylog
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_login_events_tallylog:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_privileged_commands">
            <xccdf-1.2:title>Record Information on the Use of Privileged Commands</xccdf-1.2:title>
            <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_privileged_commands_init" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - init</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/init -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/init -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000730</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271573r1092564_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of the init command may cause availability issues for the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_privileged_commands_init"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/init -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_privileged_commands_init" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000730
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_init
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/init
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/init -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/init -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/init -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/init -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/init -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/init -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000730
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_init
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_privileged_commands_init:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_privileged_commands_init_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_privileged_commands_poweroff" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - poweroff</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/poweroff -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/poweroff -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000735</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271574r1092566_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of the poweroff command may cause availability issues for the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_privileged_commands_poweroff"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/poweroff -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_privileged_commands_poweroff" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000735
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_poweroff
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/poweroff
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/poweroff -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/poweroff -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/poweroff -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/poweroff -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/poweroff -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/poweroff -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000735
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_poweroff
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_privileged_commands_poweroff:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_privileged_commands_poweroff_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_privileged_commands_reboot" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - reboot</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/reboot -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/reboot -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000740</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271575r1092568_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of the reboot command may cause availability issues for the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_privileged_commands_reboot"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/reboot -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_privileged_commands_reboot" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000740
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_reboot
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/reboot
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/reboot -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/reboot -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/reboot -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/reboot -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/reboot -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/reboot -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000740
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_reboot
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_privileged_commands_reboot:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_privileged_commands_reboot_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_privileged_commands_shutdown" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - shutdown</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/shutdown -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/shutdown -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000745</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271576r1092570_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of the shutdown command may cause availability issues for the system.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_privileged_commands_shutdown"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/shutdown -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_privileged_commands_shutdown" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000745
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_shutdown
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/shutdown
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/shutdown -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/shutdown -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/shutdown -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/shutdown -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/shutdown -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/shutdown -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000745
  - NIST-800-53-AU-12(c)
  - audit_privileged_commands_shutdown
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_privileged_commands_shutdown:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_privileged_commands_shutdown_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description>The audit system should collect information about usage of privileged commands for all users.
These are commands with suid or sgid bits on and they are specially risky in local block
device partitions not mounted with noexec and nosuid options. Therefore, these partitions
should be first identified by the following command:
<html:pre>findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid"</html:pre>

For all partitions listed by the previous command, it is necessary to search for
setuid / setgid programs using the following command:
<html:pre>$ sudo find <html:i>PARTITION</html:i> -xdev -perm /6000 -type f 2&gt;/dev/null</html:pre>

For each setuid / setgid program identified by the previous command, an audit rule must be
present in the appropriate place using the following line structure:
<html:pre>-a always,exit -F path=<html:i>PROG_PATH</html:i> -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code> program to read
audit rules during daemon startup, add the line to a file with suffix <html:code>.rules</html:code> in the
<html:code>/etc/audit/rules.d</html:code> directory, replacing the <html:i>PROG_PATH</html:i> part with the full path
of that setuid / setgid identified program.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility instead, add
the line to the <html:code>/etc/audit/audit.rules</html:code> file, also replacing the <html:i>PROG_PATH</html:i> part
with the full path of that setuid / setgid identified program.</xccdf-1.2:description>
              <xccdf-1.2:warning category="general">This rule checks for multiple syscalls related to privileged commands. If needed to check
specific privileged commands, other more specific rules should be considered. For example:
<html:ul><html:li><html:code>audit_rules_privileged_commands_su</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_umount</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_passwd</html:code></html:li></html:ul>
       </xccdf-1.2:warning>
              <xccdf-1.2:warning category="general">Note that OVAL check and Bash / Ansible remediation of this rule
explicitly excludes file systems mounted at <html:code>/proc</html:code> directory
and its subdirectories. It is a virtual file system and it doesn't
contain executable applications. At the same time, interacting with this
file system during check or remediation caused undesirable errors.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO08.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002234</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by authorized users,
or by unauthorized external entities that have compromised system accounts, is a serious and
ongoing concern that can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify the
risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert
their normal role of providing some necessary but limited capability. As such, motivation
exists to monitor these programs for unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""

function add_audit_rule()
{
    local PRIV_CMD="$1"
    local OTHER_FILTERS="-F path=$PRIV_CMD -F perm=x"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
}

if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then
  PRIV_CMDS=$(find / -perm /6000 -type f -not -path "/sysroot/*" 2&gt;/dev/null)
  for PRIV_CMD in $PRIV_CMDS; do
    add_audit_rule $PRIV_CMD
  done
else
  FILTER_NODEV=$(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
  PARTITIONS=$(findmnt -n -l -k -it "$FILTER_NODEV" | grep -Pv "noexec|nosuid|/proc($|/.*$)" | awk '{ print $1 }')
  for PARTITION in $PARTITIONS; do
    PRIV_CMDS=$(find "${PARTITION}" -xdev -perm /6000 -type f 2&gt;/dev/null)
    for PRIV_CMD in $PRIV_CMDS; do
      add_audit_rule $PRIV_CMD
    done
  done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Set
    List of Mount Points Which Permits Execution of Privileged Commands
  ansible.builtin.set_fact:
    privileged_mount_points: '{{ (ansible_facts.mounts | rejectattr(''options'', ''search'',
      ''noexec|nosuid'') | rejectattr(''mount'', ''match'', ''/proc($|/.*$)'') | map(attribute=''mount'')
      | list ) }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Search
    for Privileged Commands in Eligible Mount Points
  ansible.builtin.shell:
    cmd: find {{ item }} -xdev -perm /6000 -type f 2&gt;/dev/null
  register: result_privileged_commands_search
  changed_when: false
  failed_when: false
  with_items: '{{ privileged_mount_points }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Set
    List of Privileged Commands Found in Eligible Mount Points
  ansible.builtin.set_fact:
    privileged_commands: '{{ privileged_commands | default([]) + item.stdout_lines
      }}'
  loop: '{{ result_privileged_commands_search.results }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - item is not skipped
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Privileged
    Commands are Present in the System
  block:

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Ensure
      Rules for All Privileged Commands in augenrules Format
    ansible.builtin.lineinfile:
      path: /etc/audit/rules.d/privileged.rules
      line: -a always,exit -F path={{ item }} -F perm=x -F auid&gt;=1000 -F auid!=unset
        -F key=privileged
      regexp: ^.*path={{ item | regex_escape() }} .*$
      create: true
    with_items:
    - '{{ privileged_commands }}'

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Ensure
      Rules for All Privileged Commands in auditctl Format
    ansible.builtin.lineinfile:
      path: /etc/audit/audit.rules
      line: -a always,exit -F path={{ item }} -F perm=x -F auid&gt;=1000 -F auid!=unset
        -F key=privileged
      regexp: ^.*path={{ item | regex_escape() }} .*$
      create: true
    with_items:
    - '{{ privileged_commands }}'

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Search
      for Duplicated Rules in Other Files
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      recurse: false
      contains: ^-a always,exit -F path={{ item }} .*$
      patterns: '*.rules'
    with_items:
    - '{{ privileged_commands }}'
    register: result_augenrules_files

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Ensure
      Rules for Privileged Commands are Defined Only in One File
    ansible.builtin.lineinfile:
      path: '{{ item.1.path }}'
      regexp: ^-a always,exit -F path={{ item.0.item }} .*$
      state: absent
    with_subelements:
    - '{{ result_augenrules_files.results }}'
    - files
    when:
    - item.1.path != '/etc/audit/rules.d/privileged.rules'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - privileged_commands is defined
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_at"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/at -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_at" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_at
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/at
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/at -F perm=x -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/at -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/at -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_at
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_at:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_at_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000550</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271537r1092494_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_chage"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chage -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_chage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000550
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_chage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chage
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000550
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_chage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_chage:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_chage_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000565</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271540r1092500_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_chsh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chsh -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_chsh" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000565
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_chsh
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/chsh
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000565
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_chsh
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_chsh:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_chsh_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000570</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271541r1092502_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_crontab"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/crontab -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_crontab" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000570
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/crontab
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000570
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_crontab:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000575</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271542r1092504_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_gpasswd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/gpasswd -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_gpasswd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000575
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_gpasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/gpasswd
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000575
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_gpasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - kmod</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(iv)AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(1)(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000504-CTR-001280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000695</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271566r1092552_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.

Audit records can be generated from various components within the
information system (e.g., module or policy filter).</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_kmod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/kmod -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_kmod" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000695
  - NIST-800-53-AU-12(a)
  - NIST-800-53-AU-12.1(ii)
  - NIST-800-53-AU-12.1(iv)AU-12(c)
  - NIST-800-53-AU-3
  - NIST-800-53-AU-3.1
  - NIST-800-53-MA-4(1)(a)
  - audit_rules_privileged_commands_kmod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/kmod
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/kmod -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/kmod -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/kmod -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000695
  - NIST-800-53-AU-12(a)
  - NIST-800-53-AU-12.1(ii)
  - NIST-800-53-AU-12.1(iv)AU-12(c)
  - NIST-800-53-AU-3
  - NIST-800-53-AU-3.1
  - NIST-800-53-MA-4(1)(a)
  - audit_rules_privileged_commands_kmod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_kmod:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_kmod_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000630</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271553r1092526_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_mount"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/mount -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_mount" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000630
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_mount
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/mount
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000630
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_mount
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_mount:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000580</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271543r1092506_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_newgrp"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newgrp -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_newgrp" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000580
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_newgrp
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/newgrp
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000580
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_newgrp
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_newgrp:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/pam_timestamp_check
-F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/pam_timestamp_check
-F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000585</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271544r1092508_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_pam_timestamp_check"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/pam_timestamp_check -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_pam_timestamp_check" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000585
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_pam_timestamp_check
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/pam_timestamp_check
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/pam_timestamp_check -F perm=x -F auid&gt;=1000 -F auid!=unset
        (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/pam_timestamp_check
        -F perm=x -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/pam_timestamp_check
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/pam_timestamp_check -F perm=x -F auid&gt;=1000 -F auid!=unset
        (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/pam_timestamp_check
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000585
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_pam_timestamp_check
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_pam_timestamp_check:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000590</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271545r1092510_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_passwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/passwd -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_passwd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000590
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/passwd
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/passwd -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/passwd -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/passwd -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000590
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_passwd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postdrop" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - postdrop</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000595</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271546r1092512_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_postdrop"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/postdrop -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_postdrop" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000595
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_postdrop
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/postdrop
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postdrop -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postdrop -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postdrop -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000595
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_postdrop
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_postdrop:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_postdrop_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postqueue" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - postqueue</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000600</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271547r1092514_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_postqueue"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/postqueue -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_postqueue" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000600
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_postqueue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/postqueue
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postqueue -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postqueue -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postqueue -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000600
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_postqueue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_postqueue:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_postqueue_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_agent" severity="medium">
              <xccdf-1.2:title>Record Any Attempts to Run ssh-agent</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect any execution attempt
of the <html:code>ssh-agent</html:code> command for all users and root. If the <html:code>auditd</html:code>
daemon is configured to use the <html:code>augenrules</html:code> program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-ssh-agent</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-ssh-agent</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000605</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271548r1092516_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.

Audit records can be generated from various components within the
information system (e.g., module or policy filter).</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_ssh_agent"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/ssh-agent -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_ssh_agent" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000605
  - audit_rules_privileged_commands_ssh_agent
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/ssh-agent
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/ssh-agent -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/ssh-agent -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/ssh-agent -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000605
  - audit_rules_privileged_commands_ssh_agent
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_ssh_agent:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_ssh_agent_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000610</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271549r1092518_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_ssh_keysign"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/libexec/openssh/ssh-keysign -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_ssh_keysign" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000610
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_ssh_keysign
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/libexec/openssh/ssh-keysign
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset
        (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/openssh/ssh-keysign
        -F perm=x -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/openssh/ssh-keysign
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset
        (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/openssh/ssh-keysign
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000610
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_ssh_keysign
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-0003</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000755-GPOS-00220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000540</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271535r1092490_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_su"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/su -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_su" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000540
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_su
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/su
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F perm=x -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000540
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_su
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_su:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_su_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000755-GPOS-00220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000670</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271561r1092542_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_sudo"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/sudo -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_sudo" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000670
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/sudo
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000670
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_sudo:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_sudo_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000755-GPOS-00220</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000615</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271550r1092520_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_sudoedit"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/sudoedit -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_sudoedit" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000615
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_sudoedit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/sudoedit
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudoedit -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudoedit -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudoedit -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000615
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_sudoedit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_sudoedit_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000705</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271568r1092556_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_umount"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/umount -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_umount" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000705
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_umount
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/bin/umount
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F perm=x -F
        auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F perm=x
        -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000705
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_umount
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_umount:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(1)(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000029-CTR-000085</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000620</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271551r1092522_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_unix_chkpwd"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/unix_chkpwd -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_unix_chkpwd" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000620
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(a)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-12.1(ii)
  - NIST-800-53-AU-12.1(iv)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-AU-3
  - NIST-800-53-AU-3.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(1)(a)
  - audit_rules_privileged_commands_unix_chkpwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/unix_chkpwd
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000620
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(a)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-12.1(ii)
  - NIST-800-53-AU-12.1(iv)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-AU-3
  - NIST-800-53-AU-3.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(1)(a)
  - audit_rules_privileged_commands_unix_chkpwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_update" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_update</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000535</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271534r1092488_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_unix_update"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/unix_update -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_unix_update" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000535
  - audit_rules_privileged_commands_unix_update
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/unix_update
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_update -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_update
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_update
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000535
  - audit_rules_privileged_commands_unix_update
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_unix_update:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_unix_update_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000625</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271552r1092524_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_userhelper"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/userhelper -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_userhelper" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000625
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_userhelper
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/userhelper
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/userhelper -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/userhelper
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/userhelper
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000625
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_userhelper
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_userhelper:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - usermod</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000499-CTR-001255</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000675</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271562r1092544_rule</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_usermod"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/usermod -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_usermod" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000675
  - audit_rules_privileged_commands_usermod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/usermod
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usermod -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usermod -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usermod -F
        perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000675
  - audit_rules_privileged_commands_usermod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_usermod:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_usermod_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" severity="medium">
              <xccdf-1.2:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</xccdf-1.2:title>
              <xccdf-1.2:description>At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the <html:code>auditd</html:code> daemon is
configured to use the <html:code>augenrules</html:code> program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/>
        <html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_privileged_commands_usernetctl"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/usernetctl -F perm=x"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_privileged_commands_usernetctl" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_usernetctl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for /usr/sbin/usernetctl
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usernetctl -F perm=x
        -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usernetctl
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usernetctl
        -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_privileged_commands_usernetctl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_time_rules">
            <xccdf-1.2:title>Records Events that Modify Date and Time Information</xccdf-1.2:title>
            <xccdf-1.2:description>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time. All changes to the system
time should be audited.</xccdf-1.2:description>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" severity="medium">
              <xccdf-1.2:title>Record attempts to alter time through adjtimex</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_adjtimex"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_adjtimex" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of adjtimex in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of adjtimex in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday

  - name: Check existence of adjtimex in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of adjtimex in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_time_adjtimex:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Time Through clock_settime</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport.
Multiple system calls can be defined on the same line to save space if
desired, but is not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_clock_settime"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a0=0x0"
	AUID_FILTERS=""
	SYSCALL="clock_settime"
	KEY="time-change"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_clock_settime" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
    set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
    set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_time_clock_settime:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" severity="medium">
              <xccdf-1.2:title>Record attempts to alter time through settimeofday</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_settimeofday"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_settimeofday" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for 32bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for 64bit platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_time_settimeofday:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter Time Through stime</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> for both 32 bit and 64 bit systems:
<html:pre>-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). If the
<html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility to
read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file for both 32 bit and 64 bit systems:
<html:pre>-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). The -k option
allows for the specification of a key in string form that can be used for
better reporting capability through ausearch and aureport. Multiple system
calls can be defined on the same line to save space if desired, but is not
required. See an example of multiple combined system calls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="#not_aarch64_arch_and_not_s390x_arch"/>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_stime"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek &amp;&amp; { ( ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ) &amp;&amp; ! ( ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) ) ); }; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_stime" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_stime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for stime syscall for x86 platform
  block:

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - stime
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of stime in /etc/audit/rules.d/
    find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
      | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    set_fact:
      syscalls:
      - stime
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of stime in /etc/audit/audit.rules
    find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item')
      | list }}"

  - name: Declare missing syscalls
    set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

  - name: Replace the audit rule in {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - ( not ( ansible_architecture == "aarch64" ) and not ( ansible_architecture ==
    "s390x" ) )
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_stime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_time_stime:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" severity="medium">
              <xccdf-1.2:title>Record Attempts to Alter the localtime File</xccdf-1.2:title>
              <xccdf-1.2:description>If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/localtime -p wa -k audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/localtime -p wa -k audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport and
should always be used.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</xccdf-1.2:reference>
              <xccdf-1.2:rationale>Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_rules_time_watch_localtime"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_time_rules.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/localtime" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_time_rules.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_time_rules.rules"
    # If the audit_time_rules.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "^[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_rules_time_watch_localtime" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_time_rules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the rule
  set_fact:
    all_files:
    - /etc/audit/rules.d/audit_time_rules.rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/localtime -p wa -k audit_time_rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/localtime -p wa -k audit_time_rules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_rules_time_watch_localtime:def:1"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_auditd_data_retention">
          <xccdf-1.2:title>Configure auditd Data Retention</xccdf-1.2:title>
          <xccdf-1.2:description>The audit system writes data to <html:code>/var/log/audit/audit.log</html:code>. By default,
<html:code>auditd</html:code> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
data in total, and refuses to write entries when the disk is too
full. This minimizes the risk of audit data filling its partition
and impacting other services. This also minimizes the risk of the audit
daemon temporarily disabling the system if it cannot write audit log (which
it can be configured to do).

For a busy
system or a system which is thoroughly auditing system activity, the default settings
for data retention may be
 insufficient. The log file size needed will depend heavily on what types
of events are being audited. First configure auditing to log all the events of
interest. Then monitor the log size manually for awhile to determine what file
size will allow you to keep the required data for the correct time period.
<html:br/>
      <html:br/>
Using a dedicated partition for <html:code>/var/log/audit</html:code> prevents the
<html:code>auditd</html:code> logs from disrupting system functionality if they fill, and,
more importantly, prevents other activity in <html:code>/var</html:code> from filling the
partition and stopping the audit trail. (The audit logs are size-limited and
therefore unlikely to grow without bound unless configured to do so.) Some
machines may have requirements that no actions occur which cannot be audited.
If this is the case, then <html:code>auditd</html:code> can be configured to halt the machine
if it runs out of space. <html:b>Note:</html:b> Since older logs are rotated,
configuring <html:code>auditd</html:code> this way does not prevent older logs from being
rotated away before they can be viewed.

<html:i>If your system is configured to halt when logging cannot be performed, make
sure this can never happen under normal circumstances! Ensure that
<html:code>/var/log/audit</html:code> is on its own partition, and that this partition is
larger than the maximum amount of data <html:code>auditd</html:code> will retain
normally.</html:i>
     </xccdf-1.2:description>
          <xccdf-1.2:platform idref="#package_audit"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" type="string">
            <xccdf-1.2:title>Account for auditd to send email when actions occurs</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for action_mail_acct in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value selector="admin">admin</xccdf-1.2:value>
            <xccdf-1.2:value>root</xccdf-1.2:value>
            <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" type="string">
            <xccdf-1.2:title>Action for auditd to take when disk space is low</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for admin_space_left_action in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value>single</xccdf-1.2:value>
            <xccdf-1.2:value selector="email">email</xccdf-1.2:value>
            <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
            <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
            <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
            <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
            <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel8">single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel9">single|halt</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" type="string">
            <xccdf-1.2:title>Action for auditd to take when disk errors</xccdf-1.2:title>
            <xccdf-1.2:description>'The setting for disk_error_action in /etc/audit/auditd.conf, if multiple
values are allowed write them separated by pipes as in "syslog|single|halt",
for remediations the first value will be taken'</xccdf-1.2:description>
            <xccdf-1.2:value>single</xccdf-1.2:value>
            <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
            <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
            <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
            <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            <xccdf-1.2:value selector="ol8">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="rhel8">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel8">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel9">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_ubuntu2404">syslog|single|halt</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" type="string">
            <xccdf-1.2:title>Action for auditd to take when disk is full</xccdf-1.2:title>
            <xccdf-1.2:description>'The setting for disk_full_action in /etc/audit/auditd.conf, if multiple
values are allowed write them separated by pipes as in "syslog|single|halt",
for remediations the first value will be taken'</xccdf-1.2:description>
            <xccdf-1.2:value>single</xccdf-1.2:value>
            <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
            <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
            <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
            <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
            <xccdf-1.2:value selector="ol8">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="rhel8">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel8">syslog|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel9">halt|single</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_ubuntu2404">halt|single</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_flush" type="string">
            <xccdf-1.2:title>Auditd priority for flushing data to disk</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for flush in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value selector="data">data</xccdf-1.2:value>
            <xccdf-1.2:value>data</xccdf-1.2:value>
            <xccdf-1.2:value selector="incremental">incremental</xccdf-1.2:value>
            <xccdf-1.2:value selector="incremental_async">incremental_async</xccdf-1.2:value>
            <xccdf-1.2:value selector="none">none</xccdf-1.2:value>
            <xccdf-1.2:value selector="sync">sync</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_freq" type="number" interactive="true">
            <xccdf-1.2:title>Number of Record to Retain Before Flushing to Disk</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for freq in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value selector="50">50</xccdf-1.2:value>
            <xccdf-1.2:value selector="100">100</xccdf-1.2:value>
            <xccdf-1.2:value>50</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" type="string">
            <xccdf-1.2:title>Action for auditd to take when log files reach their maximum size</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for max_log_file_action in /etc/audit/auditd.conf. The following options are available:
<html:br/>ignore - audit daemon does nothing.
<html:br/>syslog - audit daemon will issue a warning to syslog.
<html:br/>suspend - audit daemon will stop writing records to the disk.
<html:br/>rotate - audit daemon will rotate logs in the same convention used by logrotate.
<html:br/>keep_logs - similar to rotate but prevents audit logs to be overwritten. May trigger space_left_action if volume is full.</xccdf-1.2:description>
            <xccdf-1.2:value>rotate</xccdf-1.2:value>
            <xccdf-1.2:value selector="keep_logs">keep_logs</xccdf-1.2:value>
            <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
            <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
            <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_name_format" type="string">
            <xccdf-1.2:title>Type of hostname to record the audit event</xccdf-1.2:title>
            <xccdf-1.2:description>Type of hostname to record the audit event</xccdf-1.2:description>
            <xccdf-1.2:value>hostname</xccdf-1.2:value>
            <xccdf-1.2:value selector="hostname">hostname</xccdf-1.2:value>
            <xccdf-1.2:value selector="fqd">fqd</xccdf-1.2:value>
            <xccdf-1.2:value selector="numeric">numeric</xccdf-1.2:value>
            <xccdf-1.2:value selector="user">user</xccdf-1.2:value>
            <xccdf-1.2:value selector="none">none</xccdf-1.2:value>
            <xccdf-1.2:value selector="stig">hostname|fqd|numeric</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left" type="number">
            <xccdf-1.2:title>Size remaining in disk space before prompting space_left_action</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for space_left (MB) in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value selector="1000MB">1000</xccdf-1.2:value>
            <xccdf-1.2:value selector="100MB">100</xccdf-1.2:value>
            <xccdf-1.2:value selector="250MB">250</xccdf-1.2:value>
            <xccdf-1.2:value selector="500MB">500</xccdf-1.2:value>
            <xccdf-1.2:value selector="750MB">750</xccdf-1.2:value>
            <xccdf-1.2:value>100</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" type="string">
            <xccdf-1.2:title>Action for auditd to take when disk space just starts to run low</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for space_left_action in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value>email</xccdf-1.2:value>
            <xccdf-1.2:value selector="email">email</xccdf-1.2:value>
            <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
            <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
            <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
            <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
            <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel8">email|exec|single|halt</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel9">email|exec|single|halt</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" type="number" interactive="true">
            <xccdf-1.2:title>The percentage remaining in disk space before prompting space_left_action</xccdf-1.2:title>
            <xccdf-1.2:description>The setting for space_left as a percentage in /etc/audit/auditd.conf</xccdf-1.2:description>
            <xccdf-1.2:value selector="25pc">25</xccdf-1.2:value>
            <xccdf-1.2:value selector="50pc">50</xccdf-1.2:value>
            <xccdf-1.2:value selector="75pc">75</xccdf-1.2:value>
            <xccdf-1.2:value>25</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_sufficiently_large_partition" severity="medium">
            <xccdf-1.2:title>Configure a Sufficiently Large Partition for Audit Logs</xccdf-1.2:title>
            <xccdf-1.2:description>The Oracle Linux 9 operating system must allocate audit record storage
capacity to store at least one weeks worth of audit records when audit
records are not immediately sent to a central audit record storage
facility.

The partition size needed to capture a week's worth of audit records is
based on the activity level of the system and the total storage capacity
available.

In normal circumstances, 10.0 GB of storage space for audit
records will be sufficient.


Determine which partition the audit records are being written to with the
following command:

<html:pre>$ sudo grep log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log</html:pre>

Check the size of the partition that audit records are written to with the
following command:

<html:pre>$ sudo df -h /var/log/audit/
/dev/sda2 24G 10.4G 13.6G 43% /var/log/audit</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001849</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000850</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271596r1091500_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Information stored in one location is vulnerable to accidental or incidental
deletion or alteration. Off-loading is a common process in information
systems with limited audit storage capacity.</xccdf-1.2:rationale>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" severity="medium">
            <xccdf-1.2:title>Configure auditd to use audispd's syslog plugin</xccdf-1.2:title>
            <xccdf-1.2:description>To configure the <html:code>auditd</html:code> service to use the
<html:code>syslog</html:code> plug-in of the <html:code>audispd</html:code> audit event multiplexor, set
the <html:code>active</html:code> line in <html:code>/etc/audit/plugins.d/syslog.conf</html:code> to <html:code>yes</html:code>.
Restart the <html:code>auditd</html:code> service:
<html:pre>$ sudo service auditd restart</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000855</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271597r1092586_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The auditd service does not include the ability to send audit
records to a centralized server for management directly. It does, however,
include a plug-in for audit event multiplexor (audispd) to pass audit records
to the local syslog server.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_audispd_syslog_plugin_activated"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_syslog_active="yes"

AUDISP_SYSLOGCONFIG=/etc/audit/plugins.d/syslog.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^active")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_syslog_active"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^active\\&gt;" "$AUDISP_SYSLOGCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^active\\&gt;.*/$escaped_formatted_output/gi" "$AUDISP_SYSLOGCONFIG"
else
    if [[ -s "$AUDISP_SYSLOGCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDISP_SYSLOGCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDISP_SYSLOGCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDISP_SYSLOGCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_audispd_syslog_plugin_activated" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000855
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.3
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.3
  - auditd_audispd_syslog_plugin_activated
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable syslog plugin
  lineinfile:
    dest: /etc/audit/plugins.d/syslog.conf
    regexp: ^active
    line: active = yes
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000855
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.3
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.3
  - auditd_audispd_syslog_plugin_activated
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action" severity="medium">
            <xccdf-1.2:title>Configure auditd Disk Error Action on Disk Error</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when there is a disk error.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>disk_error_action = <html:i>ACTION</html:i>
       </html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include

<html:code>syslog</html:code>, <html:code>exec</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>

For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000098-CTR-000185</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000099-CTR-000190</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000100-CTR-000195</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000100-CTR-000200</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000109-CTR-000215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000290-CTR-000670</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000357-CTR-000800</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Taking appropriate action in case of disk errors will minimize the possibility of
losing audit records.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_disk_error_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_disk_error_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" use="legacy"/>'


#
# If disk_error_action present in /etc/audit/auditd.conf, change value
# to var_auditd_disk_error_action, else
# add "disk_error_action = $var_auditd_disk_error_action" to /etc/audit/auditd.conf
#
var_auditd_disk_error_action="$(echo $var_auditd_disk_error_action | cut -d \| -f 1)"

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^disk_error_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_disk_error_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^disk_error_action\\&gt;" "/etc/audit/auditd.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^disk_error_action\\&gt;.*/$escaped_formatted_output/gi" "/etc/audit/auditd.conf"
else
    if [[ -s "/etc/audit/auditd.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/audit/auditd.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/audit/auditd.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/audit/auditd.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_disk_error_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_error_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_disk_error_action # promote to variable
  set_fact:
    var_auditd_disk_error_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Error Action on Disk Error
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_error_action = {{ var_auditd_disk_error_action.split('|')[0] }}
    regexp: ^\s*disk_error_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_error_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_disk_error_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_disk_error_action:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig" severity="medium">
            <xccdf-1.2:title>Configure auditd Disk Error Action on Disk Error</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when there is a disk error.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>disk_error_action = <html:i>ACTION</html:i>
       </html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include <html:code>syslog</html:code>,
<html:code>exec</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000760</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271579r1091449_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Taking appropriate action in case of disk errors will minimize the possibility of
losing audit records.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_disk_error_action_stig"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_disk_error_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^disk_error_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_disk_error_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^disk_error_action\\&gt;" "/etc/audit/auditd.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^disk_error_action\\&gt;.*/$escaped_formatted_output/gi" "/etc/audit/auditd.conf"
else
    if [[ -s "/etc/audit/auditd.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/audit/auditd.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/audit/auditd.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/audit/auditd.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_disk_error_action_stig" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000760
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_error_action_stig
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_disk_error_action # promote to variable
  set_fact:
    var_auditd_disk_error_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Error Action on Disk Error
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_error_action = {{ var_auditd_disk_error_action }}
    regexp: ^\s*disk_error_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000760
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_error_action_stig
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_disk_error_action_stig:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_disk_error_action_stig_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action" severity="medium">
            <xccdf-1.2:title>Configure auditd Disk Full Action when Disk Space Is Full</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>disk_full_action = <html:i>ACTION</html:i>
       </html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include

<html:code>syslog</html:code>, <html:code>exec</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>

For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Taking appropriate action in case of a filled audit storage volume will minimize
the possibility of losing audit records.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_disk_full_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_disk_full_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" use="legacy"/>'


var_auditd_disk_full_action="$(echo $var_auditd_disk_full_action | cut -d \| -f 1)"

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^disk_full_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_disk_full_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^disk_full_action\\&gt;" "/etc/audit/auditd.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^disk_full_action\\&gt;.*/$escaped_formatted_output/gi" "/etc/audit/auditd.conf"
else
    if [[ -s "/etc/audit/auditd.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/audit/auditd.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/audit/auditd.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/audit/auditd.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_disk_full_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_full_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_disk_full_action # promote to variable
  set_fact:
    var_auditd_disk_full_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Full Action when Disk Space Is Full
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_full_action = {{ var_auditd_disk_full_action.split('|')[0] }}
    regexp: ^\s*disk_full_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_full_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_disk_full_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_disk_full_action:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig" severity="medium">
            <xccdf-1.2:title>Configure auditd Disk Full Action when Disk Space Is Full</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>disk_full_action = <html:i>ACTION</html:i>
       </html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single-user
mode for corrective action. Acceptable values also include <html:code>syslog</html:code>,
<html:code>single</html:code>, and <html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000765</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271580r1091452_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Taking appropriate action in case of a filled audit storage volume will minimize
the possibility of losing audit records.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_disk_full_action_stig"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_disk_full_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^disk_full_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_disk_full_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^disk_full_action\\&gt;" "/etc/audit/auditd.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^disk_full_action\\&gt;.*/$escaped_formatted_output/gi" "/etc/audit/auditd.conf"
else
    if [[ -s "/etc/audit/auditd.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/audit/auditd.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/audit/auditd.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/audit/auditd.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_disk_full_action_stig" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000765
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_full_action_stig
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_disk_full_action # promote to variable
  set_fact:
    var_auditd_disk_full_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd Disk Full Action when Disk Space Is Full
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: disk_full_action = {{ var_auditd_disk_full_action }}
    regexp: ^\s*disk_full_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000765
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - auditd_data_disk_full_action_stig
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_disk_full_action_stig:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_disk_full_action_stig_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" severity="medium">
            <xccdf-1.2:title>Configure auditd mail_acct Action on Low Disk Space</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in <html:code>/etc/audit/auditd.conf</html:code> to ensure that administrators are notified
via email for those situations:
<html:pre>action_mail_acct = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
       </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-003-8 R5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7.a</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000825</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271591r1092578_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_action_mail_acct"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_action_mail_acct='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^action_mail_acct")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_action_mail_acct"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^action_mail_acct\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^action_mail_acct\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_action_mail_acct" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000825
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)
  - PCI-DSS-Req-10.7.a
  - auditd_data_retention_action_mail_acct
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_action_mail_acct # promote to variable
  set_fact:
    var_auditd_action_mail_acct: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
  tags:
    - always

- name: Configure auditd mail_acct Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: action_mail_acct = {{ var_auditd_action_mail_acct }}
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000825
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)
  - PCI-DSS-Req-10.7.a
  - auditd_data_retention_action_mail_acct
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_action_mail_acct:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_action_mail_acct:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" severity="medium">
            <xccdf-1.2:title>Configure auditd admin_space_left Action on Low Disk Space</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>admin_space_left_action = <html:i>ACTION</html:i>
       </html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single user
mode for corrective action. Acceptable values also include <html:code>suspend</html:code> and
<html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000875</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000885</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271601r1091515_rule</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271603r1092592_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Administrators should be made aware of an inability to record
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_admin_space_left_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_admin_space_left_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>'


var_auditd_admin_space_left_action="$(echo $var_auditd_admin_space_left_action | cut -d \| -f 1)"

AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^admin_space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_admin_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^admin_space_left_action\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^admin_space_left_action\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_admin_space_left_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000875
  - DISA-STIG-OL09-00-000885
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_admin_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_admin_space_left_action # promote to variable
  set_fact:
    var_auditd_admin_space_left_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd admin_space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: admin_space_left_action = {{ var_auditd_admin_space_left_action .split('|')[0]
      }}
    regexp: ^\s*admin_space_left_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000875
  - DISA-STIG-OL09-00-000885
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_admin_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_admin_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_admin_space_left_action:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" severity="medium">
            <xccdf-1.2:title>Configure auditd flush priority</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to
synchronously write audit event data to disk. Add or correct the following
line in <html:code>/etc/audit/auditd.conf</html:code> to ensure that audit event data is
fully synchronized with the log files on the disk:
<html:pre>flush = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/>
       </html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001576</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R2.2.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-004-6 R3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/AlignRep/One%20Stop%20Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Audit data should be synchronously written to disk to ensure
log integrity. These parameters assure that all audit event data is fully
synchronized with the log files on the disk.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_flush"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_flush='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# if flush is present, flush param edited to var_auditd_flush
# else flush param is defined by var_auditd_flush
#
# the freq param is only used for values 'incremental' and 'incremental_async' and will be
# commented out if flush != incremental or flush != incremental_async
#
# if flush == incremental or flush == incremental_async &amp;&amp; freq param is not defined, it 
# will be defined as the package-default value of 20

grep -q ^flush $AUDITCONFIG &amp;&amp; \
  sed -i 's/^flush.*/flush = '"$var_auditd_flush"'/g' $AUDITCONFIG
if ! [ $? -eq 0 ]; then
  echo "flush = $var_auditd_flush" &gt;&gt; $AUDITCONFIG
fi

if ! [ "$var_auditd_flush" == "incremental" ] &amp;&amp; ! [ "$var_auditd_flush" == "incremental_async" ]; then
  sed -i 's/^freq/##freq/g' $AUDITCONFIG
elif [ "$var_auditd_flush" == "incremental" ] || [ "$var_auditd_flush" == "incremental_async" ]; then
  grep -q freq $AUDITCONFIG &amp;&amp; \
    sed -i 's/^#\+freq/freq/g' $AUDITCONFIG
  if ! [ $? -eq 0 ]; then
    echo "freq = 20" &gt;&gt; $AUDITCONFIG
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_flush" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-11
  - NIST-800-53-CM-6(a)
  - auditd_data_retention_flush
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_flush # promote to variable
  set_fact:
    var_auditd_flush: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_flush" use="legacy"/>
  tags:
    - always

- name: Configure auditd Flush Priority
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*flush\s*=\s*.*$
    line: flush = {{ var_auditd_flush }}
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-11
  - NIST-800-53-CM-6(a)
  - auditd_data_retention_flush
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_flush:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_flush"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_flush:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" severity="medium">
            <xccdf-1.2:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</xccdf-1.2:title>
            <xccdf-1.2:description>The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <html:code>auditd</html:code>, add or correct the line in <html:code>/etc/audit/auditd.conf</html:code>:
<html:pre>max_log_file_action = <html:i>ACTION</html:i>
       </html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man
page. These include:
<html:ul><html:li><html:code>ignore</html:code></html:li><html:li><html:code>syslog</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>rotate</html:code></html:li><html:li><html:code>keep_logs</html:code></html:li></html:ul>
Set the <html:code><html:i>ACTION</html:i></html:code> to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/></html:code>.
The setting is case-insensitive.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.ccn-cert.cni.es/es/guias-de-acceso-publico-ccn-stic/6669-ccn-stic-620-guia-de-aplicaciones-de-perfilado-de-seguridad-para-oracle-linux/file.html">A.3.SEC-OL6</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Automatically rotating logs (by setting this to <html:code>rotate</html:code>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<html:code>keep_logs</html:code> can be employed.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_max_log_file_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_max_log_file_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file_action\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^max_log_file_action\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_max_log_file_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_max_log_file_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_max_log_file_action:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig" severity="medium">
            <xccdf-1.2:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</xccdf-1.2:title>
            <xccdf-1.2:description>The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <html:code>auditd</html:code>, add or correct the line in <html:code>/etc/audit/auditd.conf</html:code>:
<html:pre>max_log_file_action = <html:i>ACTION</html:i>
       </html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man
page. These include:
<html:ul><html:li><html:code>ignore</html:code></html:li><html:li><html:code>syslog</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>rotate</html:code></html:li><html:li><html:code>keep_logs</html:code></html:li></html:ul>
Set the <html:code><html:i>ACTION</html:i></html:code> to <html:code>rotate</html:code> to ensure log rotation
occurs. This is the default. The setting is case-insensitive.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000098-CTR-000185</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000099-CTR-000190</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000100-CTR-000195</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000100-CTR-000200</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000109-CTR-000215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000290-CTR-000670</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000357-CTR-000800</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000770</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271581r1091455_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Automatically rotating logs (by setting this to <html:code>rotate</html:code>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<html:code>keep_logs</html:code> can be employed.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_max_log_file_action_stig"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_max_log_file_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file_action\\&gt;" "/etc/audit/auditd.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^max_log_file_action\\&gt;.*/$escaped_formatted_output/gi" "/etc/audit/auditd.conf"
else
    if [[ -s "/etc/audit/auditd.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/audit/auditd.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/audit/auditd.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/audit/auditd.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_max_log_file_action_stig" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000770
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file_action_stig
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000770
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file_action_stig
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_max_log_file_action_stig:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_max_log_file_action_stig_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left" severity="medium">
            <xccdf-1.2:title>Configure auditd space_left on Low Disk Space</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>SIZE_in_MB</html:i> appropriately:
<html:pre>space_left = <html:i>SIZE_in_MB</html:i>
       </html:pre>
Set this value to the appropriate size in Megabytes cause the system to
notify the user of an issue.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Notifying administrators of an impending disk space problem may allow them to
take corrective action prior to any disruption.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_space_left"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_space_left='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left" use="legacy"/>'


grep -q "^space_left[[:space:]]*=.*$" /etc/audit/auditd.conf &amp;&amp; \
  sed -i "s/^space_left[[:space:]]*=.*$/space_left = $var_auditd_space_left/g" /etc/audit/auditd.conf || \
  echo "space_left = $var_auditd_space_left" &gt;&gt; /etc/audit/auditd.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_space_left" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_space_left
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_space_left # promote to variable
  set_fact:
    var_auditd_space_left: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left = {{ var_auditd_space_left }}
    regexp: ^\s*space_left\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_space_left
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_space_left:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_space_left:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_space_left_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" severity="medium">
            <xccdf-1.2:title>Configure auditd space_left Action on Low Disk Space</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space <html:i>starts</html:i> to run low.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>space_left_action = <html:i>ACTION</html:i>
       </html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man page.
These include:
<html:ul><html:li><html:code>syslog</html:code></html:li><html:li><html:code>email</html:code></html:li><html:li><html:code>exec</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>single</html:code></html:li><html:li><html:code>halt</html:code></html:li></html:ul>
Set this to <html:code>email</html:code> (instead of the default,
which is <html:code>suspend</html:code>) as it is more likely to get prompt attention. Acceptable values
also include <html:code>suspend</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000870</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271600r1091512_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_space_left_action"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_space_left_action='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>'


var_auditd_space_left_action="$(echo $var_auditd_space_left_action | cut -d \| -f 1)"
#
# If space_left_action present in /etc/audit/auditd.conf, change value
# to var_auditd_space_left_action, else
# add "space_left_action = $var_auditd_space_left_action" to /etc/audit/auditd.conf
#

AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^space_left_action\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^space_left_action\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_space_left_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000870
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_space_left_action # promote to variable
  set_fact:
    var_auditd_space_left_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left_action = {{ var_auditd_space_left_action.split('|')[0] }}
    regexp: ^\s*space_left_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - CJIS-5.4.1.1
  - DISA-STIG-OL09-00-000870
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_space_left_action:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage" severity="medium">
            <xccdf-1.2:title>Configure auditd space_left on Low Disk Space</xccdf-1.2:title>
            <xccdf-1.2:description>The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>PERCENTAGE</html:i> appropriately:
<html:pre>space_left = <html:i>PERCENTAGE</html:i>%</html:pre>
Set this value to at least 25 to cause the system to
notify the user of an issue.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000865</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271599r1091509_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Notifying administrators of an impending disk space problem may allow them to
take corrective action prior to any disruption.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_data_retention_space_left_percentage"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_space_left_percentage='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" use="legacy"/>'


grep -q "^space_left[[:space:]]*=.*$" /etc/audit/auditd.conf &amp;&amp; \
  sed -i "s/^space_left[[:space:]]*=.*$/space_left = $var_auditd_space_left_percentage%/g" /etc/audit/auditd.conf || \
  echo "space_left = $var_auditd_space_left_percentage%" &gt;&gt; /etc/audit/auditd.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_data_retention_space_left_percentage" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000865
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_space_left_percentage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_space_left_percentage # promote to variable
  set_fact:
    var_auditd_space_left_percentage: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left = {{ var_auditd_space_left_percentage }}%
    regexp: ^\s*space_left\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000865
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_space_left_percentage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_space_left_percentage:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_data_retention_space_left_percentage:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_data_retention_space_left_percentage_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_freq" severity="medium">
            <xccdf-1.2:title>Set number of records to cause an explicit flush to audit logs</xccdf-1.2:title>
            <xccdf-1.2:description>To configure Audit daemon to issue an explicit flush to disk command
after writing <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_freq" use="legacy"/> records, set <html:code>freq</html:code> to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_freq" use="legacy"/></html:code>
in <html:code>/etc/audit/auditd.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000154</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000775</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271582r1092574_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If option <html:code>freq</html:code> isn't set to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_freq" use="legacy"/></html:code>, the flush to disk
may happen after higher number of records, increasing the danger
of audit loss.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_freq" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*freq\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "freq = 50" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_freq" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000775
  - NIST-800-53-CM-6
  - auditd_freq
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set number of records to cause an explicit flush to audit logs
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*freq\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*freq\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*freq\s*=\s*
      line: freq = 50
      state: present
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000775
  - NIST-800-53-CM-6
  - auditd_freq
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_freq:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_freq_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_local_events" severity="medium">
            <xccdf-1.2:title>Include Local Events in Audit Logs</xccdf-1.2:title>
            <xccdf-1.2:description>To configure Audit daemon to include local events in Audit logs, set
<html:code>local_events</html:code> to <html:code>yes</html:code> in <html:code>/etc/audit/auditd.conf</html:code>.
This is the default setting.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000800</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271586r1092576_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If option <html:code>local_events</html:code> isn't set to <html:code>yes</html:code> only events from
network will be aggregated.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_local_events" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*local_events\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "local_events = yes" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_local_events" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000800
  - NIST-800-53-CM-6
  - auditd_local_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Include Local Events in Audit Logs
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*local_events\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*local_events\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*local_events\s*=\s*
      line: local_events = yes
      state: present
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000800
  - NIST-800-53-CM-6
  - auditd_local_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_local_events:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_local_events_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_log_format" severity="low">
            <xccdf-1.2:title>Resolve information before writing to audit logs</xccdf-1.2:title>
            <xccdf-1.2:description>To configure Audit daemon to resolve all uid, gid, syscall,
architecture, and socket address information before writing the
events to disk, set <html:code>log_format</html:code> to <html:code>ENRICHED</html:code>
in <html:code>/etc/audit/auditd.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000096-CTR-000175</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000097-CTR-000180</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000098-CTR-000185</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000099-CTR-000190</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000100-CTR-000195</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000100-CTR-000200</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000109-CTR-000215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000290-CTR-000670</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000357-CTR-000800</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000835</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271593r1092580_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If option <html:code>log_format</html:code> isn't set to <html:code>ENRICHED</html:code>, the
audit records will be stored in a format exactly as the kernel sends them.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_log_format" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*log_format\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "log_format = ENRICHED" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_log_format" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000835
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6
  - auditd_log_format
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy

- name: Resolve information before writing to audit logs
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*log_format\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*log_format\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*log_format\s*=\s*
      line: log_format = ENRICHED
      state: present
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000835
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6
  - auditd_log_format
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_log_format:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_log_format_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_name_format" severity="medium">
            <xccdf-1.2:title>Set type of computer node name logging in audit logs</xccdf-1.2:title>
            <xccdf-1.2:description>To configure Audit daemon to use a unique identifier
as computer node name in the audit events,
set <html:code>name_format</html:code> to <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_name_format" use="legacy"/></html:code>
in <html:code>/etc/audit/auditd.conf</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:warning category="general">Whenever the variable <html:pre>var_auditd_name_format</html:pre> uses a multiple value option, for example
<html:pre>A|B|C</html:pre>, the first value will be used when remediating this rule.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000132</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000755</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271578r1092572_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If option <html:code>name_format</html:code> is left at its default value of
<html:code>none</html:code>, audit events from different computers may be hard
to distinguish.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_name_format" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

var_auditd_name_format='<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_name_format" use="legacy"/>'


var_auditd_name_format="$(echo $var_auditd_name_format | cut -d \| -f 1)"

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*name_format\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "name_format = $var_auditd_name_format" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_name_format" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000755
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.2
  - auditd_name_format
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_name_format # promote to variable
  set_fact:
    var_auditd_name_format: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_name_format" use="legacy"/>
  tags:
    - always

- name: Set type of computer node name logging in audit logs - Define Value to Be
    Used in the Remediation
  ansible.builtin.set_fact: auditd_name_format_split="{{ var_auditd_name_format.split('|')[0]
    }}"
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000755
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.2
  - auditd_name_format
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set type of computer node name logging in audit logs
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*name_format\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*name_format\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*name_format\s*=\s*
      line: name_format = {{ auditd_name_format_split }}
      state: present
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000755
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.2
  - auditd_name_format
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_name_format:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_name_format"/>
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_name_format:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_name_format_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_overflow_action" severity="medium">
            <xccdf-1.2:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</xccdf-1.2:title>
            <xccdf-1.2:description>The audit system should have an action setup in the event the internal event queue becomes full.
To setup an overflow action edit <html:code>/etc/audit/auditd.conf</html:code>. Set <html:code>overflow_action</html:code>
to one of the following values: <html:code>syslog</html:code>, <html:code>single</html:code>, <html:code>halt</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001851</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000860</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271598r1092588_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>The audit system should have an action setup in the event the internal event queue becomes full
so that no data is lost.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_overflow_action" complexity="low" disruption="low" reboot="true" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*overflow_action\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "overflow_action = syslog" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_overflow_action" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000860
  - NIST-800-53-AU-4(1)
  - auditd_overflow_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*overflow_action\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*overflow_action\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*overflow_action\s*=\s*
      line: overflow_action = syslog
      state: present
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000860
  - NIST-800-53-AU-4(1)
  - auditd_overflow_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_overflow_action:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_overflow_action_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_auditd_write_logs" severity="medium">
            <xccdf-1.2:title>Write Audit Logs to the Disk</xccdf-1.2:title>
            <xccdf-1.2:description>To configure Audit daemon to write Audit logs to the disk, set
<html:code>write_logs</html:code> to <html:code>yes</html:code> in <html:code>/etc/audit/auditd.conf</html:code>.
This is the default setting.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000880</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271602r1092590_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If <html:code>write_logs</html:code> isn't set to <html:code>yes</html:code>, the Audit logs will
not be written to the disk.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="auditd_write_logs" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

if [ -e "/etc/audit/auditd.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*write_logs\s*=\s*/Id" "/etc/audit/auditd.conf"
else
    touch "/etc/audit/auditd.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/audit/auditd.conf"

cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
printf '%s\n' "write_logs = yes" &gt;&gt; "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="auditd_write_logs" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000880
  - NIST-800-53-CM-6
  - auditd_write_logs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Write Audit Logs to the Disk
  block:

  - name: Check for duplicate values
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*write_logs\s*=\s*
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*write_logs\s*=\s*
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/audit/auditd.conf
    lineinfile:
      path: /etc/audit/auditd.conf
      create: true
      regexp: (?i)(?i)^\s*write_logs\s*=\s*
      line: write_logs = yes
      state: present
  when:
  - '"audit" in ansible_facts.packages'
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000880
  - NIST-800-53-CM-6
  - auditd_write_logs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-auditd_write_logs:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-auditd_write_logs_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_file_permissions_auditd">
          <xccdf-1.2:title>System Accounting with auditd</xccdf-1.2:title>
          <xccdf-1.2:description>The audit service provides substantial capabilities
for recording system activities. This section
deals with permissions of auditd related files.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_auditd" severity="medium">
            <xccdf-1.2:title>Verify Permissions on /etc/audit/auditd.conf</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/audit/auditd.conf</html:code>, run the command:
<html:pre>$ sudo chmod 0640 /etc/audit/auditd.conf</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000810</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271588r1091476_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without the capability to restrict the roles and individuals that can select which events
are audited, unauthorized personnel may be able to prevent the auditing of critical
events. Misconfigured audits may degrade the system's performance by overwhelming
the audit log. Misconfigured audits may also make it more difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_audit_auditd" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

chmod u-xs,g-xws,o-xwrt /etc/audit/auditd.conf

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_audit_auditd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000810
  - NIST-800-53-AU-12(b)
  - configure_strategy
  - file_permissions_etc_audit_auditd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/audit/auditd.conf
  stat:
    path: /etc/audit/auditd.conf
  register: file_exists
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000810
  - NIST-800-53-AU-12(b)
  - configure_strategy
  - file_permissions_etc_audit_auditd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/audit/auditd.conf
  file:
    path: /etc/audit/auditd.conf
    mode: u-xs,g-xws,o-xwrt
  when:
  - ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - DISA-STIG-OL09-00-000810
  - NIST-800-53-AU-12(b)
  - configure_strategy
  - file_permissions_etc_audit_auditd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_audit_auditd:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_audit_auditd_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_rulesd" severity="medium">
            <xccdf-1.2:title>Verify Permissions on /etc/audit/rules.d/*.rules</xccdf-1.2:title>
            <xccdf-1.2:description>
To properly set the permissions of <html:code>/etc/audit/rules.d/*.rules</html:code>, run the command:
<html:pre>$ sudo chmod 0600 /etc/audit/rules.d/*.rules</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000171</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">OL09-00-000805</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/srg-stig-tools/">SV-271587r1091473_rule</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without the capability to restrict the roles and individuals that can select which events
are audited, unauthorized personnel may be able to prevent the auditing of critical
events. Misconfigured audits may degrade the system's performance by overwhelming
the audit log. Misconfigured audits may also make it more difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="file_permissions_etc_audit_rulesd" complexity="low" disruption="low" reboot="false" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

find -L /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*rules$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="file_permissions_etc_audit_rulesd" complexity="low" disruption="low" reboot="false" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL09-00-000805
  - NIST-800-53-AU-12(b)
  - configure_strategy
  - file_permissions_etc_audit_rulesd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s)
  command: find -H /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
    f -regextype posix-extended -regex "^.*rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000805
  - NIST-800-53-AU-12(b)
  - configure_strategy
  - file_permissions_etc_audit_rulesd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/audit/rules.d/ file(s)
  file:
    path: '{{ item }}'
    mode: u-xs,g-xwrs,o-xwrt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - DISA-STIG-OL09-00-000805
  - NIST-800-53-AU-12(b)
  - configure_strategy
  - file_permissions_etc_audit_rulesd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-file_permissions_etc_audit_rulesd:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-file_permissions_etc_audit_rulesd_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_policy_rules">
          <xccdf-1.2:title>System Accounting with auditd</xccdf-1.2:title>
          <xccdf-1.2:description>The <html:code>auditd</html:code> program can perform comprehensive
monitoring of system activity. This section makes use of recommended
configuration settings for specific policies or use cases.
The rules in this section make use of rules defined in <html:code>/usr/share/doc/audit-VERSION/rules</html:code>.</xccdf-1.2:description>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_access_failed" severity="medium">
            <xccdf-1.2:title>Configure auditing of unsuccessful file accesses</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that unsuccessful attempts to access a file are audited.

The following rules configure audit as described above:
<html:pre>## Unsuccessful file access (any other opens) This has to go last.
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unsuccessful attempts to access a file might be signs of malicious activity happening within the system. Auditing of such activities helps in their monitoring and investigation.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_access_failed" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
## Unsuccessful file access (any other opens) This has to go last.
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_access_failed" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_access_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
    content: |
      ## Unsuccessful file access (any other opens) This has to go last.
      -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
      -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
      -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
      -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_access_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of unsuccessful file accesses - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_access_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_access_failed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_access_failed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_access_success" severity="medium">
            <xccdf-1.2:title>Configure auditing of successful file accesses</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that successful attempts to access a file are audited.

The following rules configure audit as described above:
<html:pre>## Successful file access (any other opens) This has to go last.
## These next two are likely to result in a whole lot of events
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0584</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">05885</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0586</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0957</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing of successful attempts to access a file helps in investigation of activities performed on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_access_success" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-3-access-success.rules
## Successful file access (any other opens) This has to go last.
## These next two are likely to result in a whole lot of events
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-3-access-success.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_access_success" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_access_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-3-access-success.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-3-access-success.rules
    content: |
      ## Successful file access (any other opens) This has to go last.
      ## These next two are likely to result in a whole lot of events
      -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
      -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_access_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of successful file accesses - Remove any permissions from
    group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-3-access-success.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_access_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_access_success:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_access_success_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_basic_configuration" severity="medium">
            <xccdf-1.2:title>Configure basic parameters of Audit system</xccdf-1.2:title>
            <xccdf-1.2:description>Perform basic configuration of Audit system.
Make sure that any previously defined rules are cleared, the auditing system is configured to handle sudden bursts of events, and in cases of failure, messages are configured to be directed to system log.

The following rules configure audit as described above:
<html:pre>## First rule - delete all
-D

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 60000

## Set failure mode to syslog
-f 1    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:warning category="performance">It might happen that Audit buffer configured by this rule is not large enough for certain use cases. If that is the case, the buffer size can be overridden by placing <html:pre>-b larger_buffer_size</html:pre> into a file within <html:code>/etc/audit/rules.d</html:code> directory, replacing <html:code>larger_file_size</html:code> with the desired value. The file name should start with a number higher than 10 and lower than 99.</xccdf-1.2:warning>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Without basic configurations, audit may not perform as expected. It may not be able to correctly handle events under stressful conditions, or log events in case of failure.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_basic_configuration" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/10-base-config.rules
## First rule - delete all
-D

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 60000

## Set failure mode to syslog
-f 1

EOF

chmod o-rwx /etc/audit/rules.d/10-base-config.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_basic_configuration" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_basic_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/10-base-config.rules according to policy
  copy:
    dest: /etc/audit/rules.d/10-base-config.rules
    content: |+
      ## First rule - delete all
      -D

      ## Increase the buffers to survive stress events.
      ## Make this bigger for busy systems
      -b 8192

      ## This determine how long to wait in burst of events
      --backlog_wait_time 60000

      ## Set failure mode to syslog
      -f 1

    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_basic_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure basic parameters of Audit system - Remove any permissions from group
    and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/10-base-config.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_basic_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_basic_configuration:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_basic_configuration_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_create_failed" severity="medium">
            <xccdf-1.2:title>Configure auditing of unsuccessful file creations</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that unsuccessful attempts to create a file are audited.

The following rules configure audit as described above:
<html:pre>## Unsuccessful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_create_failed" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules
## Unsuccessful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_create_failed" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_create_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules
    content: |
      ## Unsuccessful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
      -a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_create_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of unsuccessful file creations - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_create_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_create_failed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_create_failed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_create_success" severity="medium">
            <xccdf-1.2:title>Configure auditing of successful file creations</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that successful attempts to create a file are audited.

The following rules configure audit as described above:
<html:pre>## Successful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing of successful attempts to create a file helps in investigation of actions which happened on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_create_success" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-1-create-success.rules
## Successful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-1-create-success.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_create_success" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_create_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-1-create-success.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-1-create-success.rules
    content: |
      ## Successful file creation (open with O_CREAT)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
      -a always,exit -F arch=b32 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
      -a always,exit -F arch=b64 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
      -a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
      -a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_create_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of successful file creations - Remove any permissions from
    group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-1-create-success.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_create_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_create_success:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_create_success_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_delete_failed" severity="medium">
            <xccdf-1.2:title>Configure auditing of unsuccessful file deletions</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that unsuccessful attempts to delete a file are audited.

The following rules configure audit as described above:
<html:pre>## Unsuccessful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000501-CTR-001265</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000502-CTR-001270</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unsuccessful attempts to delete a file might be signs of malicious activities. Auditing of such events help in monitoring and investigating of such activities.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_delete_failed" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules
## Unsuccessful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_delete_failed" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_delete_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules
    content: |
      ## Unsuccessful file delete
      -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
      -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
      -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
      -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_delete_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of unsuccessful file deletions - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_delete_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_delete_failed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_delete_failed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_delete_success" severity="medium">
            <xccdf-1.2:title>Configure auditing of successful file deletions</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that successful attempts to delete a file are audited.

The following rules configure audit as described above:
<html:pre>## Successful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing of successful attempts to delete a file may help in monitoring and investigation of activities performed on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_delete_success" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules
## Successful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_delete_success" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_delete_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules
    content: |
      ## Successful file delete
      -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
      -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_delete_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of successful file deletions - Remove any permissions from
    group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_delete_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_delete_success:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_delete_success_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_immutable_login_uids" severity="medium">
            <xccdf-1.2:title>Configure immutable Audit login UIDs</xccdf-1.2:title>
            <xccdf-1.2:description>Configure kernel to prevent modification of login UIDs once they are set.
Changing login UIDs while this configuration is enforced requires special capabilities which
are not available to unprivileged users.

The following rules configure audit as described above:
<html:pre>## Make the loginuid immutable. This prevents tampering with the auid.
--loginuid-immutable    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000121-CTR-000255</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000495-CTR-001235</xccdf-1.2:reference>
            <xccdf-1.2:rationale>If modification of login UIDs is not prevented, they can be changed by unprivileged users and
make auditing complicated or impossible.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_immutable_login_uids" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/11-loginuid.rules
## Make the loginuid immutable. This prevents tampering with the auid.
--loginuid-immutable

EOF

chmod o-rwx /etc/audit/rules.d/11-loginuid.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_immutable_login_uids" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/11-loginuid.rules according to policy
  copy:
    dest: /etc/audit/rules.d/11-loginuid.rules
    content: |+
      ## Make the loginuid immutable. This prevents tampering with the auid.
      --loginuid-immutable

    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure immutable Audit login UIDs - Remove any permissions from group and
    other
  ansible.builtin.file:
    path: /etc/audit/rules.d/11-loginuid.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_immutable_login_uids
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_immutable_login_uids:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_immutable_login_uids_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_modify_failed" severity="medium">
            <xccdf-1.2:title>Configure auditing of unsuccessful file modifications</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that unsuccessful attempts to modify a file are audited.

The following rules configure audit as described above:
<html:pre>## Unsuccessful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000091-CTR-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000492-CTR-001220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000493-CTR-001225</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000494-CTR-001230</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000500-CTR-001260</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=container-platform">SRG-APP-000507-CTR-001295</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unsuccessful file modifications might be a sign of a malicious action being performed on the system. Auditing of such events helps in detection and investigation of such actions.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_modify_failed" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules
## Unsuccessful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_modify_failed" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_modify_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules
    content: |
      ## Unsuccessful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_modify_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of unsuccessful file modifications - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_modify_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_modify_failed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_modify_failed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_modify_success" severity="medium">
            <xccdf-1.2:title>Configure auditing of successful file modifications</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that successful attempts to modify a file are audited.

The following rules configure audit as described above:
<html:pre>## Successful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing of successful attempts to modify a file helps in investigation of actions which happened on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_modify_success" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules
## Successful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_modify_success" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_modify_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules according
    to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules
    content: |
      ## Successful file modifications (open for write or truncate)
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
      -a always,exit -F arch=b32 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
      -a always,exit -F arch=b64 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
      -a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
      -a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_modify_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of successful file modifications - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_modify_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_modify_success:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_modify_success_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_module_load" severity="medium">
            <xccdf-1.2:title>Configure auditing of loading and unloading of kernel modules</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that loading and unloading of kernel modules is audited.

The following rules configure audit as described above:
<html:pre>## These rules watch for kernel module insertion. By monitoring
## the syscall, we do not need any watches on programs.
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>
      </xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Loading of a malicious kernel module introduces a risk to the system, as the module has access to sensitive data and perform actions at the operating system kernel level. Having such events audited helps in monitoring and investigating of malicious activities.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_module_load" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/43-module-load.rules
## These rules watch for kernel module insertion. By monitoring
## the syscall, we do not need any watches on programs.
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload
EOF

chmod o-rwx /etc/audit/rules.d/43-module-load.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_module_load" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_module_load
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/43-module-load.rules according to policy
  copy:
    dest: /etc/audit/rules.d/43-module-load.rules
    content: |
      ## These rules watch for kernel module insertion. By monitoring
      ## the syscall, we do not need any watches on programs.
      -a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
      -a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
      -a always,exit -F arch=b32 -S delete_module -F key=module-unload
      -a always,exit -F arch=b64 -S delete_module -F key=module-unload
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_module_load
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of loading and unloading of kernel modules - Remove any
    permissions from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/43-module-load.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_module_load
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_module_load:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_module_load_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_ospp_general" severity="medium">
            <xccdf-1.2:title>Perform general configuration of Audit for OSPP</xccdf-1.2:title>
            <xccdf-1.2:description>Configure some basic <html:code>Audit</html:code> parameters specific for OSPP profile.
In particular, configure <html:code>Audit</html:code> to watch for direct modification of files storing system user and group information, and usage of applications with special rights which can change system configuration.
Further audited events include access to audit log it self, attempts to Alter Process and Session Initiation Information, and attempts to modify MAC controls.

The following rules configure audit as described above:
<html:pre>## The purpose of these rules is to meet the requirements for Operating
## System Protection Profile (OSPP)v4.2. These rules depends on having
## the following rule files copied to /etc/audit/rules.d:
##
## 10-base-config.rules, 11-loginuid.rules,
## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
## 30-ospp-v42-5-perm-change-failed.rules,
## 30-ospp-v42-5-perm-change-success.rules,
## 30-ospp-v42-6-owner-change-failed.rules,
## 30-ospp-v42-6-owner-change-success.rules

## User add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch passwd and
## shadow for writes
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify

## User enable and disable. This is entirely handled by pam.

## Group add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch group and
## gshadow for writes
-a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify


## Use of special rights for config changes. This would be use of setuid
## programs that relate to user accts. This is not all setuid apps because
## requirements are only for ones that affect system configuration.
-a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes

## Privilege escalation via su or sudo. This is entirely handled by pam.
## Special case for systemd-run. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
## Special case for pkexec. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation


## Watch for configuration changes to privilege escalation.
-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

## Audit log access
-a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
-a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
## Attempts to Alter Process and Session Initiation Information
-a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session

## Attempts to modify MAC controls
-a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy
-a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy

## Software updates. This is entirely handled by rpm.

## System start and shutdown. This is entirely handled by systemd

## Kernel Module loading. This is handled in 43-module-load.rules

## Application invocation. The requirements list an optional requirement
## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
## state results from that policy. This would be handled entirely by
## that daemon.    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000274-GPOS-00104</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000275-GPOS-00105</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing of events listed in the description provides data for monitoring and investigation of potentially malicious events e.g. tampering with <html:code>Audit</html:code> logs, malicious access to files storing information about system users and groups etc.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_ospp_general" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42.rules
## The purpose of these rules is to meet the requirements for Operating
## System Protection Profile (OSPP)v4.2. These rules depends on having
## the following rule files copied to /etc/audit/rules.d:
##
## 10-base-config.rules, 11-loginuid.rules,
## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
## 30-ospp-v42-5-perm-change-failed.rules,
## 30-ospp-v42-5-perm-change-success.rules,
## 30-ospp-v42-6-owner-change-failed.rules,
## 30-ospp-v42-6-owner-change-success.rules

## User add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch passwd and
## shadow for writes
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify

## User enable and disable. This is entirely handled by pam.

## Group add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch group and
## gshadow for writes
-a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify


## Use of special rights for config changes. This would be use of setuid
## programs that relate to user accts. This is not all setuid apps because
## requirements are only for ones that affect system configuration.
-a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes

## Privilege escalation via su or sudo. This is entirely handled by pam.
## Special case for systemd-run. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
## Special case for pkexec. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation


## Watch for configuration changes to privilege escalation.
-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

## Audit log access
-a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
-a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
## Attempts to Alter Process and Session Initiation Information
-a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session

## Attempts to modify MAC controls
-a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy
-a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy

## Software updates. This is entirely handled by rpm.

## System start and shutdown. This is entirely handled by systemd

## Kernel Module loading. This is handled in 43-module-load.rules

## Application invocation. The requirements list an optional requirement
## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
## state results from that policy. This would be handled entirely by
## that daemon.

EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_ospp_general" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_ospp_general
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42.rules according to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42.rules
    content: |+
      ## The purpose of these rules is to meet the requirements for Operating
      ## System Protection Profile (OSPP)v4.2. These rules depends on having
      ## the following rule files copied to /etc/audit/rules.d:
      ##
      ## 10-base-config.rules, 11-loginuid.rules,
      ## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
      ## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
      ## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
      ## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
      ## 30-ospp-v42-5-perm-change-failed.rules,
      ## 30-ospp-v42-5-perm-change-success.rules,
      ## 30-ospp-v42-6-owner-change-failed.rules,
      ## 30-ospp-v42-6-owner-change-success.rules

      ## User add delete modify. This is covered by pam. However, someone could
      ## open a file and directly create or modify a user, so we'll watch passwd and
      ## shadow for writes
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify

      ## User enable and disable. This is entirely handled by pam.

      ## Group add delete modify. This is covered by pam. However, someone could
      ## open a file and directly create or modify a user, so we'll watch group and
      ## gshadow for writes
      -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
      -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
      -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
      -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
      -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify


      ## Use of special rights for config changes. This would be use of setuid
      ## programs that relate to user accts. This is not all setuid apps because
      ## requirements are only for ones that affect system configuration.
      -a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes

      ## Privilege escalation via su or sudo. This is entirely handled by pam.
      ## Special case for systemd-run. It is not audit aware, specifically watch it
      -a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
      -a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
      ## Special case for pkexec. It is not audit aware, specifically watch it
      -a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation
      -a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation


      ## Watch for configuration changes to privilege escalation.
      -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
      -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
      -a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
      -a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

      ## Audit log access
      -a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
      -a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
      ## Attempts to Alter Process and Session Initiation Information
      -a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
      -a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
      -a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
      -a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
      -a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
      -a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session

      ## Attempts to modify MAC controls
      -a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy
      -a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy

      ## Software updates. This is entirely handled by rpm.

      ## System start and shutdown. This is entirely handled by systemd

      ## Kernel Module loading. This is handled in 43-module-load.rules

      ## Application invocation. The requirements list an optional requirement
      ## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
      ## state results from that policy. This would be handled entirely by
      ## that daemon.

    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_ospp_general
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform general configuration of Audit for OSPP - Remove any permissions from
    group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_ospp_general
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_ospp_general:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_ospp_general_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_owner_change_failed" severity="medium">
            <xccdf-1.2:title>Configure auditing of unsuccessful ownership changes</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that unsuccessful attempts to change an ownership of files or directories are audited.

The following rules configure audit as described above:
<html:pre>## Unsuccessful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unsuccessful attempts to change an ownership of files or directories might be signs of a malicious activity. Having such events audited helps in monitoring and investigation of such activities.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_owner_change_failed" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules
## Unsuccessful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_owner_change_failed" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_owner_change_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules
    according to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules
    content: |
      ## Unsuccessful ownership change
      -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
      -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
      -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
      -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_owner_change_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of unsuccessful ownership changes - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_owner_change_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_owner_change_failed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_owner_change_failed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_owner_change_success" severity="medium">
            <xccdf-1.2:title>Configure auditing of successful ownership changes</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that successful attempts to change an ownership of files or directories are audited.

The following rules configure audit as described above:
<html:pre>## Successful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing of successful ownership changes of files or directories helps in monitoring or investingating of activities performed on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_owner_change_success" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules
## Successful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_owner_change_success" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_owner_change_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules
    according to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules
    content: |
      ## Successful ownership change
      -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
      -a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_owner_change_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of successful ownership changes - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_owner_change_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_owner_change_success:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_owner_change_success_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_perm_change_failed" severity="medium">
            <xccdf-1.2:title>Configure auditing of unsuccessful permission changes</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that unsuccessful attempts to change file or directory permissions are audited.

The following rules configure audit as described above:
<html:pre>## Unsuccessful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Unsuccessful attempts to change permissions of files or directories might be signs of malicious activity. Having such events audited helps in monitoring and investigation of such activities.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_perm_change_failed" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules
## Unsuccessful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_perm_change_failed" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_perm_change_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules
    according to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules
    content: |
      ## Unsuccessful permission change
      -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
      -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
      -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
      -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_perm_change_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of unsuccessful permission changes - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_perm_change_failed
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_perm_change_failed:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_perm_change_failed_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_audit_perm_change_success" severity="medium">
            <xccdf-1.2:title>Configure auditing of successful permission changes</xccdf-1.2:title>
            <xccdf-1.2:description>Ensure that successful attempts to modify permissions of files or directories are audited.

The following rules configure audit as described above:
<html:pre>## Successful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change    </html:pre>

Load new Audit rules into kernel by running:
<html:pre>augenrules --load</html:pre>

Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs.</xccdf-1.2:description>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
            <xccdf-1.2:rationale>Auditing successful file or directory permission changes helps in monitoring and investigating of activities performed on the system.</xccdf-1.2:rationale>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="audit_perm_change_success" complexity="low" disruption="low" reboot="false" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel || rpm --quiet -q kernel-uek; then

cat &lt;&lt; 'EOF' &gt; /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules
## Successful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
EOF

chmod o-rwx /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules

augenrules --load

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix system="urn:xccdf:fix:script:ansible" id="audit_perm_change_success" complexity="low" disruption="low" reboot="false" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-2(a)
  - audit_perm_change_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Put contents into /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules
    according to policy
  copy:
    dest: /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules
    content: |
      ## Successful permission change
      -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
      -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
    force: true
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_perm_change_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure auditing of successful permission changes - Remove any permissions
    from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules
    mode: g-rwx,o-rwx
  when: ("kernel" in ansible_facts.packages or "kernel-uek" in ansible_facts.packages)
  tags:
  - NIST-800-53-AU-2(a)
  - audit_perm_change_success
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref href="ssg-ol9-oval.xml" name="oval:ssg-audit_perm_change_success:def:1"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref href="ssg-ol9-ocil.xml" name="ocil:ssg-audit_perm_change_success_ocil:questionnaire:1"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
    </xccdf-1.2:Benchmark>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-ol9-oval.xml" timestamp="2025-05-05T17:00:00">
    <oval-def:oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
      <oval-def:generator>
        <oval:product_name>OVALFileLinker from SCAP Security Guide</oval:product_name>
        <oval:product_version>ssg: [0, 1, 76], python: 3.9.21</oval:product_version>
        <oval:schema_version>5.11</oval:schema_version>
        <oval:timestamp>2025-05-06T00:00:00</oval:timestamp>
      </oval-def:generator>
      <oval-def:definitions>
        <oval-def:definition id="oval:ssg-audit_rules_immutable:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Make the auditd Configuration Immutable</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_immutable" source="ssg"/>
            <oval-def:description>Force a reboot to change audit rules is enabled</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules configuration locked" test_ref="oval:ssg-test_ari_locked_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl configuration locked" test_ref="oval:ssg-test_ari_locked_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_immutable_login_uids:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure immutable Audit login UIDs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_immutable_login_uids" source="ssg"/>
            <oval-def:description>Check if system is configured to make login UIDs immutable</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="check that --loginuid-immutable is set in /etc/audit/rules.d/*.rules" test_ref="oval:ssg-test_augen_immutable_login_uids:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="test that --loginuid-immutable is set in /etc/audit/audit.rules" test_ref="oval:ssg-test_auditctl_immutable_login_uids:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_mac_modification:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Mandatory Access Controls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_mac_modification" source="ssg"/>
            <oval-def:description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit selinux changes augenrules" test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit selinux changes auditctl" test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_mac_modification_usr_share:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Mandatory Access Controls in usr/share</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_mac_modification_usr_share" source="ssg"/>
            <oval-def:description>Audit rules that detect changes to the system's
      mandatory access controls (SELinux) in usr/share/selinux are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules in usr/share" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit selinux changes augenrules in /usr/share" test_ref="oval:ssg-test_armm_selinux_watch_augenrules_usr_share:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl in usr/share" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit selinux changes auditctl in usr/share" test_ref="oval:ssg-test_armm_selinux_watch_auditctl_usr_share:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification" source="ssg"/>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/issue augenrules" test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/issue.net augenrules" test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/hosts augenrules" test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/sysconfig/network augenrules" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1"/>
              <oval-def:extend_definition comment="audit augenrules sethostname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1"/>
              <oval-def:extend_definition comment="audit augenrules setdomainname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/issue auditctl" test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/issue.net auditctl" test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/hosts auditctl" test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/sysconfig/network auditctl" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1"/>
              <oval-def:extend_definition comment="audit augenrules sethostname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1"/>
              <oval-def:extend_definition comment="audit augenrules setdomainname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_session_events:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Process and Session Initiation Information</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_session_events" source="ssg"/>
            <oval-def:description>Audit rules should capture information about session initiation.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules utmp" test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules btmp" test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules wtmp" test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl utmp" test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl btmp" test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl wtmp" test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_sudoers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects System Administrator Actions - /etc/sudoers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_sudoers" source="ssg"/>
            <oval-def:description>Audit actions taken by system administrators on the system - /etc/sudoers.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoers" test_ref="oval:ssg-test_audit_rules_sudoers_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoers" test_ref="oval:ssg-test_audit_rules_sudoers_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_sudoers_d:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_sudoers_d" source="ssg"/>
            <oval-def:description>Audit actions taken by system administrators on the system - /etc/sudoers.d/.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoers_d" test_ref="oval:ssg-test_audit_rules_sudoers_d_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoers_d" test_ref="oval:ssg-test_audit_rules_sudoers_d_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_suid_privilege_function:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events When Privileged Executables Are Run</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_suid_privilege_function" source="ssg"/>
            <oval-def:description>Ensure audit rule for all uses of privileged functions is enabled</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit uid privileged function " test_ref="oval:ssg-test_32bit_uid_privileged_function_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 64-bit uid privileged function" test_ref="oval:ssg-test_64bit_uid_privileged_function_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit gid privileged function " test_ref="oval:ssg-test_32bit_gid_privileged_function_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 64-bit gid privileged function" test_ref="oval:ssg-test_64bit_gid_privileged_function_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit uid privileged function" test_ref="oval:ssg-test_32bit_uid_privileged_function_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 64-bit uid privileged function" test_ref="oval:ssg-test_64bit_uid_privileged_function_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit gid privileged function" test_ref="oval:ssg-test_32bit_gid_privileged_function_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 64-bit gid privileged function" test_ref="oval:ssg-test_64bit_gid_privileged_function_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects System Administrator Actions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_sysadmin_actions" source="ssg"/>
            <oval-def:description>Audit actions taken by system administrators on the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules sudoers_d" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl sudoers_d" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_system_shutdown:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Shutdown System When Auditing Failures Occur</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_system_shutdown" source="ssg"/>
            <oval-def:description>The system will shutdown when auditing fails.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules configuration shutdown" test_ref="oval:ssg-test_ars_shutdown_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl configuration shutdown" test_ref="oval:ssg-test_ars_shutdown_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_usergroup_modification:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_usergroup_modification" source="ssg"/>
            <oval-def:description>Audit rules should detect modification to system files that hold information about users and groups.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_access_var_log_audit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Access Events to Audit Log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_access_var_log_audit" source="ssg"/>
            <oval-def:description>Audit rules about the read events to /var/log/audit</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record read access events to /var/log/audit" test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record read access events to /var/log/audit" test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_group_ownership_var_log_audit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>System Audit Directories Must Be Group Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_group_ownership_var_log_audit" source="ssg"/>
            <oval-def:description>Checks that all /var/log/audit directories are group owned by the root user.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="log_file set" operator="AND">
              <oval-def:extend_definition negate="true" comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criterion comment="log directory is owned by root" test_ref="oval:ssg-test_group_ownership_var_log_audit_directories:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="log_file not set" operator="AND">
              <oval-def:extend_definition comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criterion comment="default log directory is owned by root" test_ref="oval:ssg-test_group_ownership_default_var_log_audit_directories:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="log_group in auditd.conf is not root" operator="AND">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_group_ownership_var_log_audit_directories-non_root:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_ownership_var_log_audit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>System Audit Directories Must Be Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_ownership_var_log_audit" source="ssg"/>
            <oval-def:description>Checks that all /var/log/audit directories are owned by the root user.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="directories are root owned" operator="OR">
            <oval-def:criteria comment="log_file set" operator="AND">
              <oval-def:extend_definition negate="true" comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_user_ownership_var_log_audit_path:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="log_file not set" operator="AND">
              <oval-def:extend_definition comment="log_file not set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_user_ownership_var_log_audit_directories:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_var_log_audit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Have Mode 0750 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_var_log_audit" source="ssg"/>
            <oval-def:description>Checks for correct permissions for audit logs.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="log_file set" operator="AND">
              <oval-def:extend_definition negate="true" comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criteria comment="log_group in auditd.conf is not root" operator="AND">
                <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
                <oval-def:criterion negate="true" test_ref="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion negate="true" test_ref="oval:ssg-test_dir_permissions_audit_log:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1"/>
            <oval-def:criteria comment="log_group in auditd.conf is not root" operator="AND">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion negate="true" test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_group_ownership_var_log_audit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Be Group Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_group_ownership_var_log_audit" source="ssg"/>
            <oval-def:description>Checks that all audit log files are group owned by the root user.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="log_file set" operator="AND">
              <oval-def:extend_definition negate="true" comment="log file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criteria operator="XOR">
                <oval-def:criterion comment="audit log files are root group owned" test_ref="oval:ssg-test_group_ownership_audit_log_files:tst:1"/>
                <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria comment="log_file not set" operator="AND">
              <oval-def:extend_definition comment="log file not set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criteria operator="XOR">
                <oval-def:criterion comment="default audit log files are root group owned" test_ref="oval:ssg-test_group_ownership_default_audit_log_files:tst:1"/>
                <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_ownership_var_log_audit:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Be Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_ownership_var_log_audit" source="ssg"/>
            <oval-def:description>Checks that all /var/log/audit files and directories are owned by the root user and group.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="directories are root owned" operator="AND">
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="log_group in auditd.conf is not root" operator="AND">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_var_log_audit:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Have Mode 0640 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_var_log_audit" source="ssg"/>
            <oval-def:description>Checks for correct permissions for all audit log files.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="log_file set" operator="AND">
              <oval-def:extend_definition negate="true" comment="log_file set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criterion negate="true" test_ref="oval:ssg-test_file_permissions_audit_log:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="log_file not set" operator="AND">
              <oval-def:extend_definition comment="log_file not set in auditd.conf" definition_ref="oval:ssg-auditd_conf_log_file_not_set:def:1"/>
              <oval-def:criterion negate="true" test_ref="oval:ssg-test_file_permissions_default_audit_log:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_umount:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - umount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_umount" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit umount" test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit umount" test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_file_deletion_events" source="ssg"/>
            <oval-def:description>Audit files deletion events.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit rmdir" definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1"/>
            <oval-def:extend_definition comment="audit unlink" definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1"/>
            <oval-def:extend_definition comment="audit unlinkat" definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1"/>
            <oval-def:extend_definition comment="audit rename" definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1"/>
            <oval-def:extend_definition comment="audit renameat" definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit creat" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1"/>
            <oval-def:extend_definition comment="audit ftruncate" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1"/>
            <oval-def:extend_definition comment="audit openat" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1"/>
            <oval-def:extend_definition comment="audit open_by_handle_at" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1"/>
            <oval-def:extend_definition comment="audit open" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1"/>
            <oval-def:extend_definition comment="audit truncate" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading" source="ssg"/>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit init_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1"/>
            <oval-def:extend_definition comment="audit delete_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1"/>
            <oval-def:extend_definition comment="audit finit_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_delete" source="ssg"/>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit delete_module" test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit delete_module" test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit delete_module" test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit delete_module" test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_finit" source="ssg"/>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit finit_module" test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit finit_module" test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit finit_module" test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit finit_module" test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_init" source="ssg"/>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit init_module" test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit init_module" test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit init_module" test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit init_module" test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_login_events:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_login_events" source="ssg"/>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit tallylog" definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1"/>
            <oval-def:extend_definition comment="audit faillock" definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1"/>
            <oval-def:extend_definition comment="audit lastlog" definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of privileged commands are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules format is used" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="AND">
                  <oval-def:extend_definition comment="The system is RHEL Image Mode" definition_ref="oval:ssg-bootc:def:1"/>
                  <oval-def:criterion comment="augenrules cover all privileged commands on the system" test_ref="oval:ssg-test_augenrules_all_priv_cmds_covered_bootc:tst:1"/>
                  <oval-def:criterion comment="count of augenrules for priv cmds matches count of priv cmds in the system" test_ref="oval:ssg-test_augenrules_count_matches_system_priv_cmds_bootc:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:extend_definition negate="true" comment="The system isn't RHEL Image Mode" definition_ref="oval:ssg-bootc:def:1"/>
                  <oval-def:criterion comment="augenrules cover all privileged commands on the system" test_ref="oval:ssg-test_augenrules_all_priv_cmds_covered:tst:1"/>
                  <oval-def:criterion comment="count of augenrules for priv cmds matches count of priv cmds in the system" test_ref="oval:ssg-test_augenrules_count_matches_system_priv_cmds:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl format is used" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="AND">
                  <oval-def:extend_definition comment="The system is RHEL Image Mode" definition_ref="oval:ssg-bootc:def:1"/>
                  <oval-def:criterion comment="auditctl covers all privileged commands on the system" test_ref="oval:ssg-test_auditctl_all_priv_cmds_covered:tst:1"/>
                  <oval-def:criterion comment="count of auditctl for priv cmds matches count of priv cmds in the system" test_ref="oval:ssg-test_auditctl_count_matches_system_priv_cmds:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:extend_definition negate="true" comment="The system isn't RHEL Image Mode" definition_ref="oval:ssg-bootc:def:1"/>
                  <oval-def:criterion comment="auditctl covers all privileged commands on the system" test_ref="oval:ssg-test_auditctl_all_priv_cmds_covered:tst:1"/>
                  <oval-def:criterion comment="count of auditctl for priv cmds matches count of priv cmds in the system" test_ref="oval:ssg-test_auditctl_count_matches_system_priv_cmds:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record attempts to alter time through adjtimex</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_time_adjtimex" source="ssg"/>
            <oval-def:description>Record attempts to alter time through adjtimex.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Time Through clock_settime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_time_clock_settime" source="ssg"/>
            <oval-def:description>Record attempts to alter time through clock_settime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record attempts to alter time through settimeofday</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_time_settimeofday" source="ssg"/>
            <oval-def:description>Record attempts to alter time through settimeofday.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_time_stime:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Time Through stime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_time_stime" source="ssg"/>
            <oval-def:description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria comment="32-bit or 64-bit system" operator="OR">
              <oval-def:extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
              <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="audit augenrules or audit auditctl" operator="OR">
              <oval-def:criteria comment="audit augenrules stime" operator="AND">
                <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
                <oval-def:criterion comment="audit augenrules 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="audit auditctl stime" operator="AND">
                <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
                <oval-def:criterion comment="audit auditctl 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter the localtime File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_time_watch_localtime" source="ssg"/>
            <oval-def:description>Record attempts to alter time through /etc/localtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/localtime watch augenrules" test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/localtime watch auditctl" test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd to use audispd's syslog plugin</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_audispd_syslog_plugin_activated" source="ssg"/>
            <oval-def:description>active setting in /etc/audit/plugins.d/syslog.conf is set to 'yes'</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_disk_error_action:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Error Action on Disk Error</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_disk_error_action" source="ssg"/>
            <oval-def:description>disk_error_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="disk_error_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_disk_error_action_stig:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Error Action on Disk Error</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_disk_error_action_stig" source="ssg"/>
            <oval-def:description>disk_error_action setting in /etc/audit/auditd.conf is set to SYSLOG, SINGLE or HALT</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="disk_error_action setting in auditd.conf is set to SYSLOG" test_ref="oval:ssg-test_auditd_data_disk_error_action_stig_syslog:tst:1"/>
            <oval-def:criterion comment="disk_error_action setting in auditd.conf is set to SINGLE" test_ref="oval:ssg-test_auditd_data_disk_error_action_stig_single:tst:1"/>
            <oval-def:criterion comment="disk_error_action setting in auditd.conf is set to HALT" test_ref="oval:ssg-test_auditd_data_disk_error_action_stig_halt:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_disk_full_action:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Full Action when Disk Space Is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_disk_full_action" source="ssg"/>
            <oval-def:description>disk_full_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="disk_full_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_disk_full_action_stig:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Full Action when Disk Space Is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_disk_full_action_stig" source="ssg"/>
            <oval-def:description>disk_full_action setting in /etc/audit/auditd.conf is set to SYSLOG, SINGLE or HALT</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="disk_full_action setting in auditd.conf is set to SYSLOG" test_ref="oval:ssg-test_auditd_data_disk_full_action_stig_syslog:tst:1"/>
            <oval-def:criterion comment="disk_full_action setting in auditd.conf is set to SINGLE" test_ref="oval:ssg-test_auditd_data_disk_full_action_stig_single:tst:1"/>
            <oval-def:criterion comment="disk_full_action setting in auditd.conf is set to HALT" test_ref="oval:ssg-test_auditd_data_disk_full_action_stig_halt:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd mail_acct Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_action_mail_acct" source="ssg"/>
            <oval-def:description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd admin_space_left Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_admin_space_left_action" source="ssg"/>
            <oval-def:description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_flush:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd flush priority</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_flush" source="ssg"/>
            <oval-def:description>The setting for flush in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="flush setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_max_log_file_action" source="ssg"/>
            <oval-def:description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_max_log_file_action_stig:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_max_log_file_action_stig" source="ssg"/>
            <oval-def:description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action_stig_rotate:tst:1"/>
            <oval-def:criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action_stig_single:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_space_left:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_space_left" source="ssg"/>
            <oval-def:description>space_left setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="space_left setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_space_left_action" source="ssg"/>
            <oval-def:description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_data_retention_space_left_percentage" source="ssg"/>
            <oval-def:description>space_left setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="space_left setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_name_format:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set type of computer node name logging in audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_name_format" source="ssg"/>
            <oval-def:description>Ensure 'name_format' is configured with value 'hostname|fdq|numeric' in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the name_format in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_name_format:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_overflow_action:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_overflow_action" source="ssg"/>
            <oval-def:description>Ensure 'overflow_action' is configured with value '(syslog|single|halt)' in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the overflow_action in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_overflow_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-fapolicy_default_deny:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="fapolicy_default_deny" source="ssg"/>
            <oval-def:description>Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="fapolicyd employs a deny-all policy in compiled.rules file" test_ref="oval:ssg-test_fapolicy_default_deny_policy_with_rulesd:tst:1"/>
              <oval-def:criterion comment="fapolicyd employs a deny-all policy fapolicyd.rules file" test_ref="oval:ssg-test_fapolicy_default_deny_policy_without_rulesd:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="fapolicyd is in enforcement mode" test_ref="oval:ssg-test_fapolicy_default_deny_enforcement:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-postfix_client_configure_mail_alias:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure System to Forward All Mail For The Root Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="postfix_client_configure_mail_alias" source="ssg"/>
            <oval-def:description>Check if root has the correct mail alias.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if root has the correct mail alias." operator="AND">
            <oval-def:criterion comment="Check if root has the correct mail alias." test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-postfix_client_configure_mail_alias_postmaster:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure System to Forward All Mail From Postmaster to The Root Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="postfix_client_configure_mail_alias_postmaster" source="ssg"/>
            <oval-def:description>Check if postmaster has the correct mail alias.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if postmaster has the correct mail alias." operator="AND">
            <oval-def:criterion comment="Check if postmaster has the correct mail alias." test_ref="oval:ssg-test_postfix_client_configure_mail_alias_postmaster:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-postfix_network_listening_disabled:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Postfix Network Listening</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="postfix_network_listening_disabled" source="ssg"/>
            <oval-def:description>Postfix network listening should be disabled</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="Postfix installed and configured to start" definition_ref="oval:ssg-service_postfix_enabled:def:1"/>
            <oval-def:criterion comment="Check inet_interfaces in /etc/postfix/main.cf" test_ref="oval:ssg-test_postfix_network_listening_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-postfix_prevent_unrestricted_relay:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent Unrestricted Mail Relaying</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="postfix_prevent_unrestricted_relay" source="ssg"/>
            <oval-def:description>Ensure 'smtpd_client_restrictions' is configured with value 'permit_mynetworks[ \t]*[, \t][ \t]*reject' in /etc/postfix/main.cf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="mail is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="mail is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the smtpd_client_restrictions in /etc/postfix/main.cf" test_ref="oval:ssg-test_postfix_prevent_unrestricted_relay:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/postfix/main.cf exists for postfix_prevent_unrestricted_relay" test_ref="oval:ssg-test_postfix_prevent_unrestricted_relay_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-use_kerberos_security_all_exports:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Use Kerberos Security on All Exports</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="use_kerberos_security_all_exports" source="ssg"/>
            <oval-def:description>Using Kerberos Security allows to cryptography authenticate a
      valid user to an NFS share.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check for Kerberos settings in /etc/exports" test_ref="oval:ssg-test_use_kerberos_security_all_exports:tst:1"/>
            <oval-def:criterion negate="true" comment="Check for a share in /etc/exports" test_ref="oval:ssg-test_non_empty_exports_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_client_only:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable chrony daemon from acting as server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_client_only" source="ssg"/>
            <oval-def:description>Configure the port setting in /etc/chrony.conf to disable
      server operation.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check if port is 0 in /etc/chrony.conf" test_ref="oval:ssg-test_chronyd_client_only:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_configure_pool_and_server:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Chrony Configure Pool and Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_configure_pool_and_server" source="ssg"/>
            <oval-def:description>A remote NTP Server for time synchronization should be specified (and dependencies are met)</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_chrony_remote_server_configuration:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_chrony_remote_pool_configuration:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_no_chronyc_network:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable network management of chrony daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_no_chronyc_network" source="ssg"/>
            <oval-def:description>Configure the cmdport setting in /etc/chrony.conf to disable
      chronyc management connections over network.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check if cmdport is 0 in /etc/chrony.conf" test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Time Service Maxpoll Interval</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_or_ntpd_set_maxpoll" source="ssg"/>
            <oval-def:description>Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
      to continuously poll the time source servers.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="check if maxpoll is set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1"/>
              <oval-def:criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="check if maxpoll is set in /etc/chrony.conf or /etc/chrony.d/" test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1"/>
              <oval-def:criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf or /etc/chrony.d/" test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Specify Additional Remote NTP Servers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_or_ntpd_specify_multiple_servers" source="ssg"/>
            <oval-def:description>Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="multiple chronyd remote servers specified" definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1"/>
            <oval-def:extend_definition comment="multiple ntpd remote servers specified" definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_run_as_chrony_user:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that chronyd is running under chrony user account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_run_as_chrony_user" source="ssg"/>
            <oval-def:description>Ensure that no other user than chrony is configured to run the chrony service</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="chronyd enabled and multiple remote servers specified" operator="AND">
            <oval-def:criterion comment="The default chrony user hasn't been overriden" test_ref="oval:ssg-test_no_user_override:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_server_directive:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Chrony is only configured with the server directive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_server_directive" source="ssg"/>
            <oval-def:description>Ensure Chrony has time sources configured with server directive</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf only has server directive" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_server_directive_with_server:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_server_directive_no_pool:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_specify_remote_server:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>A remote time server for Chrony is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_specify_remote_server" source="ssg"/>
            <oval-def:description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_chrony_keys:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/chrony.keys File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_chrony_keys" source="ssg"/>
            <oval-def:description>/etc/chrony.keys should be owned by chrony group</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion negate="true" comment="The /etc/nsswitch.conf does not use nss-altfiles" test_ref="oval:ssg-test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:tst:1"/>
              <oval-def:criterion comment="Check group ownership of /etc/chrony.keys" test_ref="oval:ssg-test_file_groupowner_etc_chrony_keys:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The /etc/nsswitch.conf uses nss-altfiles" test_ref="oval:ssg-test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:tst:1"/>
              <oval-def:criterion comment="Check group ownership of /etc/chrony.keys" test_ref="oval:ssg-test_file_groupowner_etc_chrony_keys_with_usrlib:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Specify Additional Remote NTP Servers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ntpd_specify_multiple_servers" source="ssg"/>
            <oval-def:description>Multiple ntpd NTP Servers for time synchronization should be specified.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="ntp.conf conditions are met" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_host_based_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove Host-Based Authentication Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_host_based_files" source="ssg"/>
            <oval-def:description>There should not be any shosts.equiv files on the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_no_shosts_equiv:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_rsh_trust_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove Rsh Trust Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_rsh_trust_files" source="ssg"/>
            <oval-def:description>There should not be any .rhosts or hosts.equiv files on the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1"/>
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1"/>
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_user_host_based_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove User Host-Based Authentication Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_user_host_based_files" source="ssg"/>
            <oval-def:description>There should not be any .shosts files on the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_no_shosts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-tftpd_uses_secure_mode:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure tftp Daemon Uses Secure Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="tftpd_uses_secure_mode" source="ssg"/>
            <oval-def:description>The TFTP daemon should use secure mode.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package tftp-server removed or /etc/xinetd.d/tftp configured correctly" operator="OR">
            <oval-def:extend_definition comment="rpm package tftp-server removed" definition_ref="oval:ssg-package_tftp-server_removed:def:1"/>
            <oval-def:criterion comment="tftpd secure mode" test_ref="oval:ssg-test_tftpd_uses_secure_mode:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SNMP Service to Use Only SNMPv3 or Newer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="snmpd_use_newer_protocol" source="ssg"/>
            <oval-def:description>SNMP version 1 and 2c must not be enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="SNMP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
            <oval-def:criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_sshd_private_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server Private *_key Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_sshd_private_key" source="ssg"/>
            <oval-def:description>The system sshd key is owned by root:root and has the 0600 permission, or by a root:ssh_keys with the 0640 permission</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="No keys that have unsafe ownership/permissions combination exist" test_ref="oval:ssg-test_no_offending_keys:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ssh_client_rekey_limit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure session renegotiation for SSH client</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ssh_client_rekey_limit" source="ssg"/>
            <oval-def:description>Ensure 'RekeyLimit' is configured with the correct value in /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/*.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="RekeyLimit is correctly configured for ssh client" operator="AND">
            <oval-def:criterion negate="true" comment="check that RekeyLimit is not configured in /etc/ssh/ssh_config" test_ref="oval:ssg-test_ssh_client_rekey_limit_main_config:tst:1"/>
            <oval-def:criterion comment="check correct RekeyLimit configuration in /etc/ssh/ssh_config.d/*.conf" test_ref="oval:ssg-test_ssh_client_rekey_limit_include_configs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-firewalld_sshd_port_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Server firewalld Firewall Exception</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="firewalld_sshd_port_enabled" source="ssg"/>
            <oval-def:description>If inbound SSH access is needed, the firewall should allow access to
        the SSH service.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Ensure default file zones have SSH service defined" test_ref="oval:ssg-test_firewalld_sshd_port_enabled_zone_ssh_enabled_usr:tst:1"/>
                <oval-def:criterion comment="Ensure default files from active zones were not overridden" test_ref="oval:ssg-test_firewalld_sshd_port_enabled_usr_zones_not_overridden:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion comment="Ensure custom files from active zones have SSH service defined" test_ref="oval:ssg-test_firewalld_sshd_port_enabled_zone_ssh_enabled_etc:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Ensure default file for SSH service is correct" test_ref="oval:ssg-test_firewalld_sshd_port_enabled_ssh_service_usr:tst:1"/>
              <oval-def:criterion comment="Ensure the modified firewalld SSH port is correct" test_ref="oval:ssg-test_firewalld_sshd_port_enabled_ssh_service_etc:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_include_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>SSHD Must Include System Crypto Policy Config File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_include_crypto_policy" source="ssg"/>
            <oval-def:description>Ensure SSHD to include the system crypto policy</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_include_crypto_policy_include_sshd_drop_in:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_sshd_include_crypto_policy_include_sshd_include_system_crypto:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_limit_user_access:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit Users' SSH Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_limit_user_access" source="ssg"/>
            <oval-def:description>One of the following parameters of the sshd configuration file is set:  AllowUsers, DenyUsers, AllowGroups, DenyGroups.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_allow_user_is_configured:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_allow_group_is_configured:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_deny_user_is_configured:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_deny_group_is_configured:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_rekey_limit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Force frequent session key renegotiation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_rekey_limit" source="ssg"/>
            <oval-def:description>Ensure RekeyLimit is configured with the appropriate value in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_rekey_limit:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_idle_timeout:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Interval</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_idle_timeout" source="ssg"/>
            <oval-def:description>The SSH idle timeout interval should be set to an
      appropriate value.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="ClientAliveInterval is configured correctly" operator="AND">
                <oval-def:criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_clientaliveinterval_present:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_login_grace_time:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SSH LoginGraceTime is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_login_grace_time" source="ssg"/>
            <oval-def:description>The SSH number seconds for login grace time should be set to an
      appropriate value.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check LoginGraceTime in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_login_grace_time:tst:1"/>
              <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_LoginGraceTime_present_sshd_set_login_grace_time:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_max_auth_tries:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set SSH authentication attempt limit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_max_auth_tries" source="ssg"/>
            <oval-def:description>The SSH MaxAuthTries should be set to an
      appropriate value.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check MaxAuthTries in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1"/>
              <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_MaxAuthTries_present_sshd_set_max_auth_tries:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_max_sessions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set SSH MaxSessions limit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_max_sessions" source="ssg"/>
            <oval-def:description>The SSH number of max sessions should be set to an
      appropriate value.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check MaxSessions in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_max_sessions:tst:1"/>
              <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_MaxSessions_present_sshd_set_max_sessions:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_maxstartups:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SSH MaxStartups is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_maxstartups" source="ssg"/>
            <oval-def:description>Ensure 'MaxStartups' is properly configured in SSH configuration files.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd MaxStartups parameter is properly configured if sshd is installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server is removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="SSH MaxStartups start parameter is less than or equal to 10" test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1"/>
              <oval-def:criterion comment="SSH MaxStartups rate parameter is greater than or equal to 30" test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1"/>
              <oval-def:criterion comment="SSH MaxStartups full parameter is less than or equal to 100" test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_use_directory_configuration:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Distribute the SSH Server configuration to multiple files in a config directory.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_use_directory_configuration" source="ssg"/>
            <oval-def:description>foo</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:extend_definition comment="sshd includes config files from its .d directory" definition_ref="oval:ssg-sshd_includes_config_files:def:1"/>
                <oval-def:criterion comment="Check the absence of match in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_use_strong_macs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Use Only Strong MACs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_use_strong_macs" source="ssg"/>
            <oval-def:description>Ensure only strong MAC algorithms are used</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
              <oval-def:criteria comment="sshd is not installed" operator="AND">
                <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
                <oval-def:extend_definition comment="package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="sshd is installed and configured" operator="AND">
                <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
                <oval-def:extend_definition comment="package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
                <oval-def:criterion comment="Check MACs in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_strong_macs:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_certificate_verification:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Certificate status checking in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_certificate_verification" source="ssg"/>
            <oval-def:description>SSSD should be configured with the correct ocsp_dgst
            digest function</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value of certificate_verification in sssd configuration" test_ref="oval:ssg-test_sssd_certificate_verification:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_enable_pam_services:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure PAM in SSSD Services</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_enable_pam_services" source="ssg"/>
            <oval-def:description>SSSD should be configured to run SSSD PAM services.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check if pam is configured in the services setting of the sssd section" test_ref="oval:ssg-test_sssd_enable_pam_services:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_enable_smartcards:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Smartcards in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_enable_smartcards" source="ssg"/>
            <oval-def:description>SSSD should be configured to authenticate access to the system
    using smart cards.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check pam_cert_auth in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1"/>
            <oval-def:criterion comment="Check allow_missing_name in /etc/pam.d/smartcard-auth" test_ref="oval:ssg-test_sssd_enable_smartcards_allow_missing_name_smartcard_auth:tst:1"/>
            <oval-def:criterion comment="Check try_cert_auth or require_cert_auth in /etc/pam.d/system-auth" test_ref="oval:ssg-test_sssd_enable_smartcards_cert_auth_system_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_offline_cred_expiration:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to Expire Offline Credentials</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_offline_cred_expiration" source="ssg"/>
            <oval-def:description>SSSD should be configured to expire offline credentials after 1 day.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1"/>
            <oval-def:criterion comment="Check cache_credentials in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_cache_credentials:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_ldap_configure_tls_reqcert:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_ldap_configure_tls_reqcert" source="ssg"/>
            <oval-def:description>Configure SSSD to request a valid certificate from the server to protect LDAP remote access sessions.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_sssd_ldap_tls_reqcert:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_ldap_start_tls:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD LDAP Backend to Use TLS For All Transactions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_ldap_start_tls" source="ssg"/>
            <oval-def:description>LDAP should be used for authentication and use STARTTLS</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="LDAP uses STARTTLS set within /etc/sssd/sssd.conf" test_ref="oval:ssg-test_use_starttls:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_usbguard_auditbackend:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Log USBGuard daemon audit events using Linux Audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_usbguard_auditbackend" source="ssg"/>
            <oval-def:description>Ensure 'AuditBackend' is configured with value 'LinuxAudit' in /etc/usbguard/usbguard-daemon.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="usbguard is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="usbguard is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the AuditBackend in /etc/usbguard/usbguard-daemon.conf" test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend" test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-usbguard_allow_hid_and_hub:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="usbguard_allow_hid_and_hub" source="ssg"/>
            <oval-def:description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-usbguard_generate_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Generate USBGuard Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="usbguard_generate_policy" source="ssg"/>
            <oval-def:description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-xwindows_remove_packages:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable graphical user interface</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="xwindows_remove_packages" source="ssg"/>
            <oval-def:description>Ensure that the default runlevel target is set to multi-user.target.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package xorg-x11-server-Xorg is not installed" test_ref="oval:ssg-package_xorg-x11-server-Xorg_removed:tst:1"/>
            <oval-def:extend_definition comment="package xorg-x11-server-common is removed" definition_ref="oval:ssg-package_xorg-x11-server-common_removed:def:1"/>
            <oval-def:criterion comment="package xorg-x11-server-utils is removed" test_ref="oval:ssg-package_xorg-x11-server-utils_removed:tst:1"/>
            <oval-def:criterion comment="package xorg-x11-server-Xwayland is removed" test_ref="oval:ssg-package_xorg-x11-server-Xwayland_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-xwindows_runlevel_target:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Graphical Environment Startup By Setting Default Target</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="xwindows_runlevel_target" source="ssg"/>
            <oval-def:description>Ensure that the default runlevel target is set to multi-user.target.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="default.target systemd softlink exists" test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-enable_authselect:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable authselect</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="enable_authselect" source="ssg"/>
            <oval-def:description>Check that authselect is enabled</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that authselect symlinks are set up properly." operator="AND">
            <oval-def:criterion comment="The 'fingerprint-auth' PAM config is a symlink to its authselect counterpart" test_ref="oval:ssg-test_pam_fingerprint_symlinked_to_authselect:tst:1"/>
            <oval-def:criterion comment="The 'password-auth' PAM config is a symlink to its authselect counterpart" test_ref="oval:ssg-test_pam_password_symlinked_to_authselect:tst:1"/>
            <oval-def:criterion comment="The 'postlogin' PAM config is a symlink to its authselect counterpart" test_ref="oval:ssg-test_pam_postlogin_symlinked_to_authselect:tst:1"/>
            <oval-def:criterion comment="The 'smartcard-auth' PAM config is a symlink to its authselect counterpart" test_ref="oval:ssg-test_pam_smartcard_symlinked_to_authselect:tst:1"/>
            <oval-def:criterion comment="The 'system-auth' PAM config is a symlink to its authselect counterpart" test_ref="oval:ssg-test_pam_system_symlinked_to_authselect:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-banner_etc_issue:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Modify the System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="banner_etc_issue" source="ssg"/>
            <oval-def:description>The system login banner text should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/etc/issue is set appropriately" test_ref="oval:ssg-test_banner_etc_issue:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-banner_etc_issue_net:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Modify the System Login Banner for Remote Connections</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="banner_etc_issue_net" source="ssg"/>
            <oval-def:description>The system login banner text should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/etc/issue.net is set appropriately" test_ref="oval:ssg-test_banner_etc_issue_net:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-banner_etc_motd:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Modify the System Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="banner_etc_motd" source="ssg"/>
            <oval-def:description>The system motd banner text should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion negate="true" comment="/etc/motd is absent" test_ref="oval:ssg-test_banner_etc_motd_exists:tst:1"/>
            <oval-def:criterion comment="/etc/motd is set appropriately" test_ref="oval:ssg-test_banner_etc_motd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_banner_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Login Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_banner_enabled" source="ssg"/>
            <oval-def:description>Enable the GNOME3 Login warning banner.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Enable GUI banner" test_ref="oval:ssg-test_banner_gui_enabled:tst:1"/>
              <oval-def:criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_login_banner_text:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set the GNOME3 Login Warning Banner Text</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_login_banner_text" source="ssg"/>
            <oval-def:description>Enable the GUI warning banner.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Prevent user from changing banner" test_ref="oval:ssg-test_prevent_user_banner_change:tst:1"/>
              <oval-def:criterion comment="Login banner is correctly set" test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-disallow_bypass_password_sudo:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="disallow_bypass_password_sudo" source="ssg"/>
            <oval-def:description>Disallow Configuration to Bypass Password Requirements for Privilege Escalation.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check absence of conf pam_succeed_if in /etc/pam.d/sudo" test_ref="oval:ssg-test_disallow_bypass_password_sudo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-display_login_attempts:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Displays Last Logon/Access Notification</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="display_login_attempts" source="ssg"/>
            <oval-def:description>Configure the system to notify users of last login/access using pam_lastlog.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="conditions for pam_lastlog are satisfied" test_ref="oval:ssg-test_display_login_attempts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_password_pam_faillock_password_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_password_pam_faillock_password_auth" source="ssg"/>
            <oval-def:description>Configure the use of the pam_faillock.so module in the /etc/pam.d/password-auth file.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="pam_unix.so appears only once in auth section of password-auth" test_ref="oval:ssg-test_pam_faillock_password_auth_pam_unix_auth:tst:1"/>
            <oval-def:criterion comment="pam_faillock.so is defined in auth section of password-auth" test_ref="oval:ssg-test_pam_faillock_password_auth_pam_faillock_auth:tst:1"/>
            <oval-def:criterion comment="pam_faillock.so is defined in account section of password-auth" test_ref="oval:ssg-test_pam_faillock_password_auth_pam_faillock_account:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_password_pam_faillock_system_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_password_pam_faillock_system_auth" source="ssg"/>
            <oval-def:description>Configure the use of the pam_faillock.so module in the /etc/pam.d/system-auth file.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="pam_unix.so appears only once in auth section of system-auth" test_ref="oval:ssg-test_pam_faillock_system_auth_pam_unix_auth:tst:1"/>
            <oval-def:criterion comment="pam_faillock.so is defined in auth section of system-auth" test_ref="oval:ssg-test_pam_faillock_system_auth_pam_faillock_auth:tst:1"/>
            <oval-def:criterion comment="pam_faillock.so is defined in account section of system-auth" test_ref="oval:ssg-test_pam_faillock_system_auth_pam_faillock_account:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_password_selinux_faillock_dir:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>An SELinux Context must be configured for the pam_faillock.so records directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_password_selinux_faillock_dir" source="ssg"/>
            <oval-def:description>An SELinux Context must be configured for the Faillock directory.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="The faillock directories should have faillog_t as context" test_ref="oval:ssg-test_account_password_selinux_faillock_dir:tst:1"/>
            <oval-def:criterion comment="There is no faillock directory set in pam_faillock.so settings" test_ref="oval:ssg-test_account_password_selinux_faillock_dir_not_set:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_passwords_pam_faillock_audit:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Account Lockouts Must Be Logged</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_passwords_pam_faillock_audit" source="ssg"/>
            <oval-def:description>Account Lockouts Must Be Logged</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check expected value for pam_faillock.so audit parameter" operator="OR">
            <oval-def:criteria comment="Check expected pam_faillock.so audit parameter in pam files" operator="AND">
              <oval-def:criterion comment="Check the audit parameter in auth section of system-auth file" test_ref="oval:ssg-test_account_pam_faillock_audit_parameter_system_auth:tst:1"/>
              <oval-def:criterion comment="Check the audit parameter in auth section of password-auth file" test_ref="oval:ssg-test_account_pam_faillock_audit_parameter_password_auth:tst:1"/>
              <oval-def:criterion comment="Ensure /etc/security/faillock.conf is not used together with pam files" test_ref="oval:ssg-test_account_pam_faillock_audit_parameter_no_faillock_conf:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected pam_faillock.so audit parameter in faillock.conf" operator="AND">
              <oval-def:criterion comment="Check the audit parameter is not present system-auth file" test_ref="oval:ssg-test_account_pam_faillock_audit_parameter_no_pamd_system:tst:1"/>
              <oval-def:criterion comment="Check the audit parameter is not present password-auth file" test_ref="oval:ssg-test_account_pam_faillock_audit_parameter_no_pamd_password:tst:1"/>
              <oval-def:criterion comment="Ensure the audit parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_account_pam_faillock_audit_parameter_faillock_conf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse: password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_pwhistory_remember_password_auth" source="ssg"/>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if pam_pwhistory.so is properly configured" operator="AND">
            <oval-def:criterion comment="pam_pwhistory.so is properly defined in password section of password-auth" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1"/>
            <oval-def:criteria comment="Check the expected value for pam_pwhistory.so remember parameter" operator="OR">
              <oval-def:criteria comment="Check the pam_pwhistory.so remember parameter is only in password-auth file" operator="AND">
                <oval-def:criterion comment="Check the remember parameter in password section of password-auth file" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pamd:tst:1"/>
                <oval-def:criterion comment="Check the pam_pwhistory.so remember parameter is absent in pwhistory.conf" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pwhistory_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check the pam_pwhistory.so remember parameter is only in pwhistory.conf file" operator="AND">
                <oval-def:criterion comment="Check the pam_pwhistory.so remember parameter is absent in password-auth file" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pamd:tst:1"/>
                <oval-def:criterion comment="Check the remember parameter in /etc/security/pwhistory.conf" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pwhistory_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse: system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_pwhistory_remember_system_auth" source="ssg"/>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if pam_pwhistory.so is properly configured" operator="AND">
            <oval-def:criterion comment="pam_pwhistory.so is properly defined in password section of system-auth" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1"/>
            <oval-def:criteria comment="Check the expected value for pam_pwhistory.so remember parameter" operator="OR">
              <oval-def:criteria comment="Check the pam_pwhistory.so remember parameter is only in system-auth file" operator="AND">
                <oval-def:criterion comment="Check the remember parameter in password section of system-auth file" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pamd:tst:1"/>
                <oval-def:criterion comment="Check the pam_pwhistory.so remember parameter is absent in pwhistory.conf" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pwhistory_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check the pam_pwhistory.so remember parameter is only in pwhistory.conf file" operator="AND">
                <oval-def:criterion comment="Check the pam_pwhistory.so remember parameter is absent in system-auth file" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pamd:tst:1"/>
                <oval-def:criterion comment="Check the remember parameter in /etc/security/pwhistory.conf" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pwhistory_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_unix_remember" source="ssg"/>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if pam_pwhistory.so or pam_unix.so are configured" operator="OR">
            <oval-def:criteria comment="Check if pam_pwhistory.so is properly configured" operator="AND">
              <oval-def:criterion comment="pam_pwhistory.so is properly defined in password section of PAM file" test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1"/>
              <oval-def:criteria comment="Check the expected value for pam_pwhistory.so remember parameter" operator="OR">
                <oval-def:criteria comment="Check the pam_pwhistory.so remember parameter is only in PAM file" operator="AND">
                  <oval-def:criterion comment="Check the remember parameter in password section of PAM file" test_ref="oval:ssg-test_accounts_password_pam_unix_remember_pamd:tst:1"/>
                  <oval-def:criterion comment="Check the pam_pwhistory.so remember parameter is absent in pwhistory.conf" test_ref="oval:ssg-test_accounts_password_pam_unix_remember_no_pwhistory_conf:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria comment="Check the pam_pwhistory.so remember parameter is only in pwhistory.conf file" operator="AND">
                  <oval-def:criterion comment="Check the pam_pwhistory.so remember parameter is absent in PAM file" test_ref="oval:ssg-test_accounts_password_pam_unix_remember_no_pamd:tst:1"/>
                  <oval-def:criterion comment="Check the remember parameter in /etc/security/pwhistory.conf" test_ref="oval:ssg-test_accounts_password_pam_unix_remember_pwhistory_conf:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion comment="Remember parameter of pam_unix.so is properly configured" test_ref="oval:ssg-test_accounts_password_pam_unix_remember_legacy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_passwords_pam_faillock_audit:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Account Lockouts Must Be Logged</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_audit" source="ssg"/>
            <oval-def:description>Account Lockouts Must Be Logged</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check expected value for pam_faillock.so audit parameter" operator="OR">
            <oval-def:criteria comment="Check expected pam_faillock.so audit parameter in pam files" operator="AND">
              <oval-def:criterion comment="Check the audit parameter in auth section of system-auth file" test_ref="oval:ssg-test_pam_faillock_audit_parameter_system_auth:tst:1"/>
              <oval-def:criterion comment="Check the audit parameter in auth section of password-auth file" test_ref="oval:ssg-test_pam_faillock_audit_parameter_password_auth:tst:1"/>
              <oval-def:criterion comment="Ensure /etc/security/faillock.conf is not used together with pam files" test_ref="oval:ssg-test_pam_faillock_audit_parameter_no_faillock_conf:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected pam_faillock.so audit parameter in faillock.conf" operator="AND">
              <oval-def:criterion comment="Check the audit parameter is not present system-auth file" test_ref="oval:ssg-test_pam_faillock_audit_parameter_no_pamd_system:tst:1"/>
              <oval-def:criterion comment="Check the audit parameter is not present password-auth file" test_ref="oval:ssg-test_pam_faillock_audit_parameter_no_pamd_password:tst:1"/>
              <oval-def:criterion comment="Ensure the audit parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_pam_faillock_audit_parameter_faillock_conf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the root Account for Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_deny_root" source="ssg"/>
            <oval-def:description>The root account should be configured to deny access after the number of
      defined failed attempts has been reached.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check the proper configuration of pam_faillock.so" operator="AND">
            <oval-def:criteria comment="Check if pam_faillock.so is properly enabled" operator="AND">
              <oval-def:criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth" operator="AND">
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1"/>
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check common definition of pam_faillock.so" operator="AND">
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected value for pam_faillock.so even_deny_root parameter" operator="OR">
              <oval-def:criteria comment="Check expected pam_faillock.so even_deny_root parameter in pam files" operator="AND">
                <oval-def:criterion comment="Check the even_deny_root parameter in auth section of system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the even_deny_root parameter in auth section of password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure /etc/security/faillock.conf is not used together with pam files" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check expected pam_faillock.so even_deny_root parameter in faillock.conf" operator="AND">
                <oval-def:criterion comment="Check the even_deny_root parameter is not present system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the even_deny_root parameter is not present password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the even_deny_root parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_passwords_pam_faillock_dir:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Lock Accounts Must Persist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_dir" source="ssg"/>
            <oval-def:description> Persist lockout account after reboot</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check expected value for pam_faillock.so dir parameter" operator="OR">
            <oval-def:criteria comment="Check expected pam_faillock.so dir parameter in pam files" operator="AND">
              <oval-def:criterion comment="Check the dir parameter in auth section of system-auth file" test_ref="oval:ssg-test_pam_faillock_dir_parameter_system_auth:tst:1"/>
              <oval-def:criterion comment="Check the dir parameter in auth section of password-auth file" test_ref="oval:ssg-test_pam_faillock_dir_parameter_password_auth:tst:1"/>
              <oval-def:criterion comment="Ensure /etc/security/faillock.conf is not used together with pam files" test_ref="oval:ssg-test_pam_faillock_dir_parameter_no_faillock_conf:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected pam_faillock.so dir parameter in faillock.conf" operator="AND">
              <oval-def:criterion comment="Check the dir parameter is not present system-auth file" test_ref="oval:ssg-test_pam_faillock_dir_parameter_no_pamd_system:tst:1"/>
              <oval-def:criterion comment="Check the dir parameter is not present password-auth file" test_ref="oval:ssg-test_pam_faillock_dir_parameter_no_pamd_password:tst:1"/>
              <oval-def:criterion comment="Ensure the dir parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_pam_faillock_dir_parameter_faillock_conf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_enforce_root:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Enforce for root User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_enforce_root" source="ssg"/>
            <oval-def:description>The password policy should also be enforced for root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for enforce_for_root are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_enforce_for_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_pwquality_password_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM password complexity module is enabled in password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_pwquality_password_auth" source="ssg"/>
            <oval-def:description>The PAM module pam_pwquality is used in password-auth</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Condition for pam_pwquality in password-auth is satisfied" operator="AND">
            <oval-def:criterion comment="pam_pwquality password-auth" test_ref="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_pwquality_system_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM password complexity module is enabled in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_pwquality_system_auth" source="ssg"/>
            <oval-def:description>The PAM module pam_pwquality is used in system-auth</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Condition for pam_pwquality in system-auth is satisfied" operator="AND">
            <oval-def:criterion comment="pam_pwquality system-auth" test_ref="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_retry:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_retry" source="ssg"/>
            <oval-def:description>The password retry should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Conditions for retry are satisfied" operator="OR">
            <oval-def:criteria comment="Conditions for retry in PAM files are satisfied" operator="AND">
              <oval-def:criterion comment="pam_pwquality has correctly set the retry argument in  password-auth" test_ref="oval:ssg-test_password_pam_pwquality_retry_password_auth:tst:1"/>
              <oval-def:criterion comment="pam_pwquality has correctly set the retry argument in  system-auth" test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="Conditions for retry in pwquality.conf file are satisfied" operator="AND">
              <oval-def:criterion comment="retry value not set in PAM files" test_ref="oval:ssg-test_password_pam_pwquality_retry_password_auth_not_set:tst:1"/>
              <oval-def:criterion comment="retry value not set in PAM files" test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth_not_set:tst:1"/>
              <oval-def:criterion comment="check retry parameter in pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Algorithm in /etc/libuser.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="set_password_hashing_algorithm_libuserconf" source="ssg"/>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_set_password_hashing_algorithm_libuserconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Algorithm in /etc/login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="set_password_hashing_algorithm_logindefs" source="ssg"/>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/login.defs.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_set_password_hashing_algorithm_logindefs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set PAM''s Password Hashing Algorithm - password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="set_password_hashing_algorithm_passwordauth" source="ssg"/>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/pam.d/password-auth.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_set_password_hashing_algorithm_passwordauth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set PAM''s Password Hashing Algorithm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="set_password_hashing_algorithm_systemauth" source="ssg"/>
            <oval-def:description>The password hashing algorithm should be set correctly in {{{ pam_file }}}.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pam_unix_hashing_algorithm_systemauth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-set_password_hashing_min_rounds_logindefs:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Minimum Rounds in /etc/login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="set_password_hashing_min_rounds_logindefs" source="ssg"/>
            <oval-def:description>The password hashing minimum rounds should be set correctly in /etc/login.defs.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_etc_login_defs_sha_crypt_min_rounds_default:tst:1"/>
                <oval-def:criterion test_ref="oval:ssg-test_var_password_hashing_min_rounds_login_defs_le_5000:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion test_ref="oval:ssg-test_etc_login_defs_sha_crypt_min_rounds_present:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion test_ref="oval:ssg-test_var_password_hashing_min_rounds_login_defs_le_5000:tst:1"/>
                <oval-def:criterion test_ref="oval:ssg-test_etc_login_defs_sha_crypt_max_rounds_default:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion negate="true" test_ref="oval:ssg-test_etc_login_defs_sha_crypt_min_rounds_default:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_etc_login_defs_sha_crypt_max_rounds_present:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-disable_ctrlaltdel_burstaction:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Burst Action</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="disable_ctrlaltdel_burstaction" source="ssg"/>
            <oval-def:description>Configure the CtrlAltDelBurstAction setting in /etc/systemd/system.conf
      or /etc/systemd/system.conf.d/* to none to prevent a reboot if Ctrl-Alt-Delete is
      pressed more than 7 times in 2 seconds.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check CtrlAltDelBurstAction is set to none" test_ref="oval:ssg-test_disable_ctrlaltdel_burstaction:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Reboot Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="disable_ctrlaltdel_reboot" source="ssg"/>
            <oval-def:description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Disable Ctrl-Alt-Del systemd softlink exists" test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_disable_interactive_boot:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that Interactive Boot is Disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_disable_interactive_boot" source="ssg"/>
            <oval-def:description>The ability for users to perform interactive startups should
      be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1"/>
              <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-logind_session_timeout:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Logind to terminate idle sessions after certain time of inactivity</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="logind_session_timeout" source="ssg"/>
            <oval-def:description>Ensure 'StopIdleSessionSec' is configured with desired value in section 'Login' in /etc/systemd/logind.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="logind is configured correctly and configuration file exists" operator="AND">
            <oval-def:criterion comment="Check the StopIdleSessionSec in /etc/systemd/logind.conf" test_ref="oval:ssg-test_logind_session_timeout:tst:1"/>
            <oval-def:criterion comment="test if configuration file /etc/systemd/logind.conf exists for logind_session_timeout" test_ref="oval:ssg-test_logind_session_timeout_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-require_emergency_target_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Require Authentication for Emergency Systemd Target</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="require_emergency_target_auth" source="ssg"/>
            <oval-def:description>The requirement for a password to boot into emergency mode
      should be configured correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_emergency_service:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1"/>
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_no_custom_emergency_target:tst:1"/>
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_no_custom_emergency_service:tst:1"/>
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_require_emergency_target_auth_drop_in_config_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-require_singleuser_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Require Authentication for Single User Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="require_singleuser_auth" source="ssg"/>
            <oval-def:description>The requirement for a password to boot into single-user mode
      should be configured correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="authentication for single user mode is configured in the file provided by distro" test_ref="oval:ssg-test_require_rescue_service_distro:tst:1"/>
                <oval-def:criterion comment="Execstart directive of rescue.service is not overridden" test_ref="oval:ssg-test_rescue_service_not_overridden:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion comment="authentication for single user mode is configured in the override file" test_ref="oval:ssg-test_require_rescue_service_override:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_opensc_card_drivers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure opensc Smart Card Drivers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_opensc_card_drivers" source="ssg"/>
            <oval-def:description>Configure the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check that card_drivers is configured for opensc" test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_unique_id:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All Accounts on the System Have Unique User IDs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_unique_id" source="ssg"/>
            <oval-def:description>All accounts on the system should have unique IDs for proper accountability.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate user IDs entries in /etc/passwd" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_authorized_local_users:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Only Authorized Local User Accounts Exist on Operating System</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_authorized_local_users" source="ssg"/>
            <oval-def:description>Besides the default operating system user, there should be no other users
      except the users that are authorized to exist locally on the operating system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="only root user and explicitly authorized users are allowed in /etc/passwd" test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-group_unique_id:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All Groups on the System Have Unique Group ID</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="group_unique_id" source="ssg"/>
            <oval-def:description>All groups on the system should have unique names for proper accountability.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate group ids entries in /etc/passwd" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_disable_inactivity_password_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Account Expiration Following Inactivity in password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_disable_inactivity_password_auth" source="ssg"/>
            <oval-def:description>The accounts should be configured to expire automatically following password expiration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="the value for the inactive parameter should be set appropriately in /etc/pam.d/password-auth" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_password_auth_inactive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_disable_inactivity_system_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Account Expiration Following Inactivity in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_disable_inactivity_system_auth" source="ssg"/>
            <oval-def:description>The accounts should be configured to expire automatically following password expiration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="the value for the inactive parameter should be set appropriately in /etc/pam.d/system-auth" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_system_auth_inactive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Account Expiration Following Inactivity</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_disable_post_pw_expiration" source="ssg"/>
            <oval-def:description>The accounts should be configured to expire automatically following password expiration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-account_unique_name:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All Accounts on the System Have Unique Names</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="account_unique_name" source="ssg"/>
            <oval-def:description>All accounts on the system should have unique names for proper accountability.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate user name entries in /etc/passwd" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Maximum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_maximum_age_login_defs" source="ssg"/>
            <oval-def:description>The maximum password age policy should meet minimum requirements.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Minimum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_minimum_age_login_defs" source="ssg"/>
            <oval-def:description>The minimum password age policy should be set appropriately.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Minimum Length in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_minlen_login_defs" source="ssg"/>
            <oval-def:description>The password minimum length should be set appropriately.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_set_max_life_existing:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Existing Passwords Maximum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_set_max_life_existing" source="ssg"/>
            <oval-def:description>Set Existing Passwords Maximum Age</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Passwords must be restricted to the appropriate maximum age for existing accounts." test_ref="oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing:tst:1"/>
            <oval-def:criterion comment="Passwords must have a maximum lifetime greater than or equal minimum password age." test_ref="oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:tst:1"/>
            <oval-def:criterion comment="Passwords must have the maximum password age set non-empty in /etc/shadow." test_ref="oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_not_empty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_set_max_life_root:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Root Account Password Maximum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_set_max_life_root" source="ssg"/>
            <oval-def:description>A maximum password age should be set for the root account</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="root max age" test_ref="oval:ssg-test_accounts_password_set_max_life_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_set_min_life_existing:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Existing Passwords Minimum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_set_min_life_existing" source="ssg"/>
            <oval-def:description>Set Existing Passwords Maximum Age</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Passwords must be restricted to the appropriate maximum age for existing accounts." test_ref="oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_existing:tst:1"/>
            <oval-def:criterion comment="Passwords must have a maximum lifetime greater than or equal minimum password age." test_ref="oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:tst:1"/>
            <oval-def:criterion comment="Passwords must have the maximum password age set non-empty in /etc/shadow." test_ref="oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_not_empty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_set_warn_age_existing:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Existing Passwords Warning Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_set_warn_age_existing" source="ssg"/>
            <oval-def:description>Set Existing Passwords Warning Age</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Passwords must be configured to the appropriate value" test_ref="oval:ssg-test_accounts_password_set_warn_age_existing:tst:1"/>
            <oval-def:criterion comment="There is no password defined in /etc/shadow" test_ref="oval:ssg-test_accounts_password_set_warn_age_existing_no_pass:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Warning Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_warn_age_login_defs" source="ssg"/>
            <oval-def:description>The password expiration warning age should be set appropriately.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_set_post_pw_existing:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set existing passwords a period of inactivity before they been locked</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_set_post_pw_existing" source="ssg"/>
            <oval-def:description>Set existing passwords a period of inactivity before they been locked</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Passwords must be configured to the appropriate value" test_ref="oval:ssg-test_accounts_set_post_pw_existing:tst:1"/>
            <oval-def:criterion comment="There is no password defined in /etc/shadow" test_ref="oval:ssg-test_accounts_set_post_pw_existing_no_pass:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_all_shadowed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify All Account Password Hashes are Shadowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_all_shadowed" source="ssg"/>
            <oval-def:description>All password hashes should be shadowed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify All Account Password Hashes are Shadowed with SHA512</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_all_shadowed_sha512" source="ssg"/>
            <oval-def:description>All password hashes should be shadowed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" comment="password hashes are shadowed using sha512" test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_last_change_is_in_past:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure all users last password change date is in the past</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_last_change_is_in_past" source="ssg"/>
            <oval-def:description>All passwords last change date is in the past.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="All passwords last change date is in the past" test_ref="oval:ssg-test_accounts_password_last_change_is_in_past:tst:1"/>
            <oval-def:criterion comment="There is no password defined in /etc/shadow" test_ref="oval:ssg-test_accounts_password_last_change_is_in_past_no_pass:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set number of Password Hashing Rounds - password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_unix_rounds_password_auth" source="ssg"/>
            <oval-def:description>The number of rounds for password hashing should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if rounds option of pam_unix is as expected" operator="OR">
            <oval-def:criterion comment="The value of rounds is set correctly in pam_unix.so" test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set number of Password Hashing Rounds - system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_unix_rounds_system_auth" source="ssg"/>
            <oval-def:description>The number of rounds for password hashing should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if rounds option of pam_unix is as expected" operator="OR">
            <oval-def:criterion comment="The value of rounds is set correctly in pam_unix.so" test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-gid_passwd_group_same:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="gid_passwd_group_same" source="ssg"/>
            <oval-def:description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_empty_passwords:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent Login to Accounts With Empty Password</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_empty_passwords" source="ssg"/>
            <oval-def:description>The file /etc/pam.d/system-auth should not contain the nullok option</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_empty_passwords_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure There Are No Accounts With Blank or Null Passwords</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_empty_passwords_etc_shadow" source="ssg"/>
            <oval-def:description>The file /etc/shadow shows that there aren't empty passwords</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="make sure there aren't blank or null passwords in /etc/shadow" test_ref="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_netrc_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify No netrc Files Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_netrc_files" source="ssg"/>
            <oval-def:description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" test_ref="oval:ssg-test_no_netrc_files_home:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Only Root Has UID 0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_no_uid_except_zero" source="ssg"/>
            <oval-def:description>Only the root account should be assigned a user id of 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_root_gid_zero:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Root Has A Primary GID 0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_root_gid_zero" source="ssg"/>
            <oval-def:description>The root account should have primary group of 0</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="tests that the root account's gid is equal to 0" test_ref="oval:ssg-test_accounts_root_gid_zero:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_pam_wheel_group_empty:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_pam_wheel_group_empty" source="ssg"/>
            <oval-def:description>Group referred by var_pam_wheel_group_for_su variable exists and has no members.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ensure_pam_wheel_group_empty_group_exists:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ensure_pam_wheel_group_empty_has_no_members:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_root_password_configured:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Authentication Required for Single User Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_root_password_configured" source="ssg"/>
            <oval-def:description>Ensure root password is configured</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="verify root password is set" test_ref="oval:ssg-test_root_password_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_direct_root_logins:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Direct root Logins Not Allowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_direct_root_logins" source="ssg"/>
            <oval-def:description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_password_auth_for_systemaccounts:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that System Accounts Are Locked</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_password_auth_for_systemaccounts" source="ssg"/>
            <oval-def:description>Ensure that System Accounts Are Locked</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="system accounts must not have a password defined" test_ref="oval:ssg-test_no_password_auth_for_systemaccounts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that System Accounts Do Not Run a Shell Upon Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_shelllogin_for_systemaccounts" source="ssg"/>
            <oval-def:description>The root account is the only system account that should have
      a login shell.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
              <oval-def:criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
              <oval-def:criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion negate="true" comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
              <oval-def:criterion negate="true" comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
              <oval-def:criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
              <oval-def:criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-restrict_serial_port_logins:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Serial Port Root Logins</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="restrict_serial_port_logins" source="ssg"/>
            <oval-def:description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-securetty_root_login_console_only:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Virtual Console Root Logins</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="securetty_root_login_console_only" source="ssg"/>
            <oval-def:description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-use_pam_wheel_for_su:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enforce usage of pam_wheel for su authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="use_pam_wheel_for_su" source="ssg"/>
            <oval-def:description>Only members of the wheel group should be able to authenticate through the su command.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-use_pam_wheel_group_for_su:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enforce Usage of pam_wheel with Group Parameter for su Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="use_pam_wheel_group_for_su" source="ssg"/>
            <oval-def:description>Only members of the group set in variable 'var_pam_wheel_group_for_su' should be able to authenticate through the su command.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_use_pam_wheel_group_for_su:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_have_homedir_login_defs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Home Directories are Created for New Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_have_homedir_login_defs" source="ssg"/>
            <oval-def:description>CREATE_HOME should be enabled</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check CREATE_HOME in /etc/login.defs" test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_logon_fail_delay:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_logon_fail_delay" source="ssg"/>
            <oval-def:description>The delay between failed authentication attempts should be
      set for all users specified in /etc/login.defs</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit the Number of Concurrent Login Sessions Allowed Per User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_max_concurrent_login_sessions" source="ssg"/>
            <oval-def:description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion negate="true" comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1"/>
              <oval-def:criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" test_ref="oval:ssg-test_maxlogins:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_polyinstantiated_tmp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Polyinstantiation of /tmp Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_polyinstantiated_tmp" source="ssg"/>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check Polyinstantiation of /tmp Directories" operator="AND">
            <oval-def:criterion comment="Check that if /tmp/tmp-inst exists and has mode 000" test_ref="oval:ssg-test_tmp_inst:tst:1"/>
            <oval-def:criterion comment="Check configuration of /tmp in /etc/security/namespace.conf file" test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Polyinstantiation of /var/tmp Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_polyinstantiated_var_tmp" source="ssg"/>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check Polyinstantiation of /tmp Directories" operator="AND">
            <oval-def:criterion comment="Check that /var/tmp/tmp-inst doesn't exist or it exists and has mode 000" test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1"/>
            <oval-def:criterion comment="Check configuration of /var/tmp in /etc/security/namespace.conf file" test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_tmout:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Interactive Session Timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_tmout" source="ssg"/>
            <oval-def:description>Checks interactive shell timeout</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="TMOUT value in /etc/profile &lt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profile_tmout:tst:1"/>
            <oval-def:criterion comment="TMOUT value in /etc/profile.d/*.sh &lt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profiled_tmout:tst:1"/>
            <oval-def:criterion comment="At least one config file has TMOUT defined" test_ref="oval:ssg-test_accounts_tmout_defined:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_user_dot_group_ownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>User Initialization Files Must Be Group-Owned By The Primary Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_user_dot_group_ownership" source="ssg"/>
            <oval-def:description>User Initialization Files Must Be Group-Owned By The Primary Group</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="User Initialization Files Must Be Group-Owned By The Primary Group" test_ref="oval:ssg-test_accounts_user_dot_group_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_user_dot_no_world_writable_programs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>User Initialization Files Must Not Run World-Writable Programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_user_dot_no_world_writable_programs" source="ssg"/>
            <oval-def:description>User Initialization Files Must Not Execute World-Writable Programs</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="User Initialization Files Must Not Execute World-Writable Programs" test_ref="oval:ssg-test_accounts_user_dot_no_world_writable_programs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_user_dot_user_ownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>User Initialization Files Must Be Owned By the Primary User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_user_dot_user_ownership" source="ssg"/>
            <oval-def:description>User Initialization Files Must Be Owned By the Primary User</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="User Initialization Files Must Be Owned By the Primary User" test_ref="oval:ssg-test_accounts_user_dot_user_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_user_interactive_home_directory_defined:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All Interactive Users Must Have A Home Directory Defined</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_user_interactive_home_directory_defined" source="ssg"/>
            <oval-def:description>All Interactive Users Must Have A Home Directory Defined</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All Interactive Users Must Have A Home Directory Defined" test_ref="oval:ssg-test_accounts_user_interactive_home_directory_defined:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_user_interactive_home_directory_exists:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All Interactive Users Home Directories Must Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_user_interactive_home_directory_exists" source="ssg"/>
            <oval-def:description>All Interactive Users Home Directories Must Exist</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="All Interactive Users Home Directories Must Exist" test_ref="oval:ssg-test_accounts_user_interactive_home_directory_exists:tst:1"/>
            <oval-def:criterion comment="Interactive users don't exist on the system" test_ref="oval:ssg-test_accounts_user_interactive_home_directory_exists_users:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_users_home_files_groupownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_users_home_files_groupownership" source="ssg"/>
            <oval-def:description>All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group" test_ref="oval:ssg-test_accounts_users_home_files_groupownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_users_home_files_ownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All User Files and Directories In The Home Directory Must Have a Valid Owner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_users_home_files_ownership" source="ssg"/>
            <oval-def:description>All User Files and Directories In The Home Directory Must Have a Valid Owner</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All User Files and Directories In The Home Directory Must Have a Valid Owner" test_ref="oval:ssg-test_accounts_users_home_files_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_users_home_files_permissions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_users_home_files_permissions" source="ssg"/>
            <oval-def:description>All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All files under interactive user's Home Directories must have proper permissions" test_ref="oval:ssg-test_accounts_users_home_files_permissions_files:tst:1"/>
            <oval-def:criterion comment="All direcories under home directories must have proper permissions" test_ref="oval:ssg-test_accounts_users_home_files_permissions_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupownership_home_directories:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All Interactive User Home Directories Must Be Group-Owned By The Primary Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupownership_home_directories" source="ssg"/>
            <oval-def:description>All interactive user's Home Directories must be group-owned by its user</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All interactive user's Home Directories must be group-owned by its user" test_ref="oval:ssg-test_file_groupownership_home_directories:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permission_user_init_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permission_user_init_files" source="ssg"/>
            <oval-def:description>User initialization files have mode 0740 or less permissive</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Initialization files have mode 0740 or less permissive" test_ref="oval:ssg-test_file_permission_user_init_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_home_directories:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_home_directories" source="ssg"/>
            <oval-def:description>All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All interactive user's Home Directories must have proper permissions" test_ref="oval:ssg-test_file_permissions_home_directories:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_home_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that User Home Directories are not Group-Writable or World-Readable</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_home_dirs" source="ssg"/>
            <oval-def:description>Ensure that User Home Directories are not Group-Writable or World-Readable</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_root_path_dirs_no_write" source="ssg"/>
            <oval-def:description>Check each directory in root's path and make use it does
      not grant write permission to group and other</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that write permission to group and other in root's path is denied" operator="AND">
            <oval-def:criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-root_path_no_dot:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="root_path_no_dot" source="ssg"/>
            <oval-def:description>The environment variable PATH should be set correctly for
      the root user.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="environment variable PATH contains dangerous path" operator="AND">
            <oval-def:criterion comment="environment variable PATH starts with : or ." test_ref="oval:ssg-test_env_var_begins:tst:1"/>
            <oval-def:criterion comment="environment variable PATH contains : twice in a row" test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1"/>
            <oval-def:criterion comment="environment variable PATH contains . twice in a row" test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1"/>
            <oval-def:criterion comment="environment variable PATH ends with : or ." test_ref="oval:ssg-test_env_var_ends:tst:1"/>
            <oval-def:criterion comment="environment variable PATH doesn't begin with a /" test_ref="oval:ssg-test_env_var_begins_slash:tst:1"/>
            <oval-def:criterion comment="environment variable PATH doesn't contain relative paths" test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_umask_etc_bashrc:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Bash Umask is Set Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_umask_etc_bashrc" source="ssg"/>
            <oval-def:description>The default umask for users of the bash shell</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_bashrc:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_umask_etc_csh_cshrc:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default C Shell Umask is Set Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_umask_etc_csh_cshrc" source="ssg"/>
            <oval-def:description>The default umask for users of the csh shell</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_umask_etc_login_defs" source="ssg"/>
            <oval-def:description>The default umask for all users specified in /etc/login.defs</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_umask_etc_profile:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly in /etc/profile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_umask_etc_profile" source="ssg"/>
            <oval-def:description>The default umask for all users should be set correctly</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_umask_interactive_users:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly For Interactive Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_umask_interactive_users" source="ssg"/>
            <oval-def:description>Ensure the Default Umask is Set Correctly For Interactive Users</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Ensure the Default Umask is Set Correctly For Interactive Users" test_ref="oval:ssg-test_accounts_umask_interactive_users:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_disable_recovery:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Recovery Booting</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_disable_recovery" source="ssg"/>
            <oval-def:description>Recovery mode should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_admin_username:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set the Boot Loader Admin Username to a Non-Default Value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_admin_username" source="ssg"/>
            <oval-def:description>The grub2 boot loader superuser should have a username that is hard to guess.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Superuser is defined in /boot/grub2/grub.cfg and it isn't             root, admin, administrator nor equal to any system username" test_ref="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_password:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Boot Loader Password in grub2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_password" source="ssg"/>
            <oval-def:description>The grub2 boot loader should have password protection enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="make sure a password is defined in /boot/grub2/user.cfg" test_ref="oval:ssg-test_grub2_password_usercfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_uefi_password:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set the UEFI Boot Loader Password</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_uefi_password" source="ssg"/>
            <oval-def:description>The UEFI grub2 boot loader should have password protection enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="make sure a password is defined in /boot/grub2/user.cfg" test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_default_mmap_min_addr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Low Address Space To Protect From User Allocation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_default_mmap_min_addr" source="ssg"/>
            <oval-def:description>The kernel config CONFIG_DEFAULT_MMAP_MIN_ADDR should have value 65536 on x86_64 and 32768 on aarch64</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Check architecture is x86_64" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_x86_64:tst:1"/>
                <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_default_mmap_min_addr_x86_64:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Check architecture is aarch64" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1"/>
                <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_default_mmap_min_addr_aarch64:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_kernel_config_default_mmap_min_addr_all_kernels:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_cron_logging:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure cron Is Logging To Rsyslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_cron_logging" source="ssg"/>
            <oval-def:description>Rsyslog should be configured to capture cron messages.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.conf" test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1"/>
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.conf using RainerScript" test_ref="oval:ssg-test_cron_logging_rsyslog_rainer:tst:1"/>
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.d" test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1"/>
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.d using RainerScript" test_ref="oval:ssg-test_cron_logging_rsyslog_dir_rainer:tst:1"/>
            <oval-def:criterion comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities" test_ref="oval:ssg-test_cron_logging_rsyslog_logging_all_facilities:tst:1"/>
            <oval-def:criterion comment="rsyslog is configured in /etc/rsyslog.d to log to all facilities" test_ref="oval:ssg-test_cron_logging_rsyslog_dir_logging_all_facilities:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" source="ssg"/>
            <oval-def:description>Rsyslogd must authenticate remote system its sending logs to.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1"/>
              <oval-def:criterion comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_rainer:tst:1"/>
              <oval-def:criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1"/>
              <oval-def:criterion comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir_rainer:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_actionsendstreamdrivermode" source="ssg"/>
            <oval-def:description>Rsyslogd must encrypt the off-loading of logs off of the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1"/>
              <oval-def:criterion comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using RainerScript" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_rainer:tst:1"/>
              <oval-def:criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1"/>
              <oval-def:criterion comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using RainerScript" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir_rainer:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_defaultnetstreamdriver" source="ssg"/>
            <oval-def:description>Rsyslogd must encrypt the off-loading of logs off of the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1"/>
              <oval-def:criterion comment="Check if DefaultNetstreamDriver is set to gtls in /etc/rsyslog.conf using RainerScript" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_rainer:tst:1"/>
              <oval-def:criterion comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1"/>
              <oval-def:criterion comment="Check if DefaultNetstreamDriver is set to gtls in files in /etc/rsyslog.d using RainerScript" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir_rainer:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_remote_access_monitoring:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure remote access methods are monitored in Rsyslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_remote_access_monitoring" source="ssg"/>
            <oval-def:description>Rsyslog should be configured to monitor remote access methods.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="remote access methods are configured in rsyslog" operator="AND">
            <oval-def:criterion comment="ensure 'auth.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1"/>
            <oval-def:criterion comment="ensure 'authpriv.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1"/>
            <oval-def:criterion comment="ensure 'daemon.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_logrotate_activated:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Logrotate Runs Periodically</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_logrotate_activated" source="ssg"/>
            <oval-def:description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="/etc/logrotate.conf contains daily setting and /etc/cron.daily/logrotate file exists" operator="AND">
            <oval-def:extend_definition comment="package logrotate installed" definition_ref="oval:ssg-package_logrotate_installed:def:1"/>
            <oval-def:criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
            <oval-def:criterion comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1"/>
            <oval-def:criteria comment="Check if either logrotate timer or cron job is enabled" operator="OR">
              <oval-def:criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
              <oval-def:criterion comment="Check if logrotate timer is enabled" test_ref="oval:ssg-test_logrotate_enabled_systemd_target:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_nolisten:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_nolisten" source="ssg"/>
            <oval-def:description>rsyslogd should reject remote messages</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="rsyslog legacy syntax is not configured to accept remote messages" test_ref="oval:ssg-test_rsyslog_nolisten_legacy:tst:1"/>
            <oval-def:criterion comment="rsyslog RainerScript is not configured to accept remote messages" test_ref="oval:ssg-test_rsyslog_nolisten_rainerscript:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_remote_loghost:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Logs Sent To Remote Host</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_remote_loghost" source="ssg"/>
            <oval-def:description>Syslog logs should be sent to a remote loghost</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
            <oval-def:criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_remote_tls:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure TLS for rsyslog remote logging</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_remote_tls" source="ssg"/>
            <oval-def:description>Check that all needed TLS-related options are present</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that rsyslog is configured to use TLS for remote logging" operator="AND">
            <oval-def:criterion comment="Check that all needed TLS-related options are present" test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_remote_tls_cacert:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure CA certificate for rsyslog remote logging</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_remote_tls_cacert" source="ssg"/>
            <oval-def:description>Check that the CA certificate path is set</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that CA certificate is configured for rsyslog remote logging" operator="AND">
            <oval-def:criterion comment="Check that the CA certificate path is set" test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-network_configure_name_resolution:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Multiple DNS Servers in /etc/resolv.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="network_configure_name_resolution" source="ssg"/>
            <oval-def:description>Multiple Domain Name System (DNS) Servers should be configured
      in /etc/resolv.conf.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="If the DNS entry is found on the host's line of the /etc/nsswitch.conf         file, verify the operating system is configured to use two or more name servers for DNS         resolution." operator="AND">
              <oval-def:criterion comment="check if dns is set in host line in  /etc/nsswitch.conf" test_ref="oval:ssg-test_host_line_dns_parameter_nsswitch:tst:1"/>
              <oval-def:criterion comment="check if more than one nameserver in /etc/resolv.conf" test_ref="oval:ssg-test_network_configure_name_resolution:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="If the DNS entry is missing from the host's line in the /etc/nsswitch.conf         file, the /etc/resolv.conf file must be empty. " operator="AND">
              <oval-def:criterion negate="true" comment="check that dns is not set in host line in  /etc/nsswitch.conf" test_ref="oval:ssg-test_host_line_dns_parameter_nsswitch:tst:1"/>
              <oval-def:criterion comment="check if /etc/resolv.conf is empty" test_ref="oval:ssg-test_file_empty_resolv:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-network_nmcli_permissions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="network_nmcli_permissions" source="ssg"/>
            <oval-def:description>polkit is properly configured to prevent non-privileged users from changing networking settings</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check for properly configured .pkla file" test_ref="oval:ssg-test_network_nmcli_permissions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-network_sniffer_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure System is Not Acting as a Network Sniffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="network_sniffer_disabled" source="ssg"/>
            <oval-def:description>Disable the network sniffer</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" comment="promisc interfaces" test_ref="oval:ssg-test_promisc_interfaces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-firewalld_loopback_traffic_restricted:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Firewalld to Restrict Loopback Traffic</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="firewalld_loopback_traffic_restricted" source="ssg"/>
            <oval-def:description>Configure Firewalld to Restrict Loopback Traffic</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Ensure default trusted zone file was not overridden" test_ref="oval:ssg-test_firewalld_trusted_zone_not_overridden:tst:1"/>
              <oval-def:criterion comment="Ensure default trusted restrict loopback source" test_ref="oval:ssg-test_firewalld_loopback_restricted_source_usr:tst:1"/>
              <oval-def:criterion comment="Ensure default trusted zone restrict loopback destination" test_ref="oval:ssg-test_firewalld_loopback_restricted_destination_usr:tst:1"/>
              <oval-def:criterion comment="Ensure default trusted zone restrict loopback traffic" test_ref="oval:ssg-test_firewalld_loopback_restricted_policy_usr:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Ensure custom trusted zone restrict loopback source" test_ref="oval:ssg-test_firewalld_loopback_restricted_source_etc:tst:1"/>
              <oval-def:criterion comment="Ensure custom trusted zone zone restrict loopback destination" test_ref="oval:ssg-test_firewalld_loopback_restricted_destination_etc:tst:1"/>
              <oval-def:criterion comment="Ensure custom trusted zone zone restrict loopback traffic" test_ref="oval:ssg-test_firewalld_loopback_restricted_policy_etc:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-firewalld_loopback_traffic_trusted:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Firewalld to Trust Loopback Traffic</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="firewalld_loopback_traffic_trusted" source="ssg"/>
            <oval-def:description>Configure Firewalld to Trust Loopback Traffic</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Ensure default trusted zone file has lo interface defined" test_ref="oval:ssg-test_firewalld_lo_interface_trusted_usr:tst:1"/>
              <oval-def:criterion comment="Ensure default trusted zone file was not overridden" test_ref="oval:ssg-test_firewalld_trusted_zone_not_overridden:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Ensure custom trusted zone file has lo interface defined" test_ref="oval:ssg-test_firewalld_lo_interface_trusted_etc:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Networking Support Automatic Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_ipv6_option_disabled" source="ssg"/>
            <oval-def:description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="ipv6 disabled any modprobe conf file" test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-wireless_disable_interfaces:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Deactivate Wireless Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="wireless_disable_interfaces" source="ssg"/>
            <oval-def:description>All wireless interfaces should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" comment="check if wifi interfaces are disabled" test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-networkmanager_dns_mode:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>NetworkManager DNS Mode Must Be Must Configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="networkmanager_dns_mode" source="ssg"/>
            <oval-def:description>Ensure 'dns' is configured with value 'default|none in section 'main' in /etc/NetworkManager/NetworkManager.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="NetworkManager is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="NetworkManager is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the dns in /etc/NetworkManager/NetworkManager.conf" test_ref="oval:ssg-test_networkmanager_dns_mode:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/NetworkManager/NetworkManager.conf exists for networkmanager_dns_mode" test_ref="oval:ssg-test_networkmanager_dns_mode_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_perms_world_writable_root_owned:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Owned by root User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_perms_world_writable_root_owned" source="ssg"/>
            <oval-def:description>All world writable directories should be owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria negate="true" operator="AND">
            <oval-def:criterion comment="check for local directories that are world writable and owner is not root" test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that All World-Writable Directories Have Sticky Bits Set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_perms_world_writable_sticky_bits" source="ssg"/>
            <oval-def:description>The sticky bit should be set for all world-writable directories.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="All local world-writable directories have sticky bit set" test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_system_commands_group_root_owned:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that system commands directories have root as a group owner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_system_commands_group_root_owned" source="ssg"/>
            <oval-def:description>
        Checks that directories /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
        have root as a group owner
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_group_ownership_system_commands_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_system_commands_root_owned:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that system commands directories have root ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_system_commands_root_owned" source="ssg"/>
            <oval-def:description>
        Checks that directories /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
        are owned by root.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="system commands directories are root owned" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ownership_system_commands_directory_bin:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_system_commands_directory_sbin:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_system_commands_directory_usr_bin:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_system_commands_directory_usr_sbin:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_system_commands_directory_usr_local_bin:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_system_commands_directory_usr_local_sbin:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All SGID Executables Are Authorized</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_unauthorized_sgid" source="ssg"/>
            <oval-def:description>Evaluates to true if all files with SGID set are owned by RPM packages.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all sgid files present in the system are authorized" test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All SUID Executables Are Authorized</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_unauthorized_suid" source="ssg"/>
            <oval-def:description>Evaluates to true if all files with SUID set are owned by RPM packages.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all suid files present in the system are authorized" test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure No World-Writable Files Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_unauthorized_world_writable" source="ssg"/>
            <oval-def:description>The world-write permission should be disabled for all files.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_ungroupowned:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All Files Are Owned by a Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_ungroupowned" source="ssg"/>
            <oval-def:description>All files should be owned by a group</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion negate="true" comment="The /etc/nsswitch.conf does not use nss-altfiles" test_ref="oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1"/>
              <oval-def:criterion comment="Check all local files and make sure they are owned by a group" test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The /etc/nsswitch.conf uses nss-altfiles" test_ref="oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1"/>
              <oval-def:criterion comment="Check all local files and make sure they are owned by a group" test_ref="oval:ssg-test_file_permissions_ungroupowned_with_usrlib:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_files_unowned_by_user:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All Files Are Owned by a User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_files_unowned_by_user" source="ssg"/>
            <oval-def:description>All files should be owned by a user</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check all files and make sure they are owned by a user" test_ref="oval:ssg-test_no_files_unowned_by_user:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupownership_system_commands_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that system commands files are group owned by root or a system account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupownership_system_commands_dirs" source="ssg"/>
            <oval-def:description>
        Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
        are owned by root group or a system account.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_ownership_binary_dirs:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executables Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_ownership_binary_dirs" source="ssg"/>
            <oval-def:description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_binary_dirs:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executables Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_binary_dirs" source="ssg"/>
            <oval-def:description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to Non-Root Local Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_nodev_nonroot_local_partitions" source="ssg"/>
            <oval-def:description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion negate="true" comment="nodev on local filesystems" test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1"/>
            <oval-def:criterion comment="nodev on local filesystems in /etc/fstab" test_ref="oval:ssg-test_nodev_nonroot_local_partitions_in_fstab:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_pattern_empty_string:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern_empty_string" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.core_pattern configuration setting check" definition_ref="oval:ssg-sysctl_kernel_core_pattern_empty_string_static:def:1"/>
            <oval-def:extend_definition comment="kernel.core_pattern runtime setting check" definition_ref="oval:ssg-sysctl_kernel_core_pattern_empty_string_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_pattern_empty_string_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern_empty_string_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.core_pattern set to an empty string" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_pattern_empty_string_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern_empty_string_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to an empty string in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /etc/sysctl.conf" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_static:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to an empty string in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_static_run_sysctld:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check that kernel_core_pattern is defined in only one file" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_defined_in_one_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-coredump_disable_backtraces:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable core dump backtraces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="coredump_disable_backtraces" source="ssg"/>
            <oval-def:description>Ensure 'ProcessSizeMax' is configured with value '0 in section 'Coredump' in /etc/systemd/coredump.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="systemd-coredump is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the ProcessSizeMax in /etc/systemd/coredump.conf" test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1"/>
            <oval-def:criterion comment="Check the ProcessSizeMax in /etc/systemd/coredump.conf.d" test_ref="oval:ssg-test_coredump_disable_backtraces_config_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-coredump_disable_storage:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dump</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="coredump_disable_storage" source="ssg"/>
            <oval-def:description>Ensure 'Storage' is configured with value 'none in section 'Coredump' in /etc/systemd/coredump.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="systemd-coredump is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the Storage in /etc/systemd/coredump.conf" test_ref="oval:ssg-test_coredump_disable_storage:tst:1"/>
            <oval-def:criterion comment="Check the Storage in /etc/systemd/coredump.conf.d" test_ref="oval:ssg-test_coredump_disable_storage_config_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-disable_users_coredumps:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for All Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="disable_users_coredumps" source="ssg"/>
            <oval-def:description>Core dumps for all users should be disabled</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Are core dumps disabled in /etc/security/limits.d/*" test_ref="oval:ssg-test_core_dumps_limits_d:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion negate="true" comment="Are core dumps configured in /etc/security/limits.d/*" test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1"/>
              <oval-def:criterion comment="Are core dumps disabled in /etc/security/limits.conf" test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable ExecShield via sysctl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_exec_shield" source="ssg"/>
            <oval-def:description>The kernel runtime parameter 'kernel.exec-shield' should not be disabled and set to 1 on 32-bit systems.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
              <oval-def:criterion comment="NX is supported and is not disabled" test_ref="oval:ssg-test_nx_disabled_grub:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-bios_enable_execution_restrictions:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable NX or XD Support in the BIOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="bios_enable_execution_restrictions" source="ssg"/>
            <oval-def:description>The NX (no-execution) bit flag should be set on the system.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NX bit is set" test_ref="oval:ssg-test_NX_cpu_support:tst:1"/>
            <oval-def:criterion comment="NX is not disabled in the kernel command line" test_ref="oval:ssg-test_noexec_cmd_line:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_enable_selinux:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux Not Disabled in /etc/default/grub</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_enable_selinux" source="ssg"/>
            <oval-def:description>
        Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" test_ref="oval:ssg-test_selinux_default_grub:tst:1"/>
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1"/>
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" test_ref="oval:ssg-test_selinux_grub_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure No Device Files are Unlabeled by SELinux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="selinux_all_devicefiles_labeled" source="ssg"/>
            <oval-def:description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_dev_device_t:tst:1"/>
            <oval-def:criterion comment="unlabeled_t in /dev" test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure No Daemons are Unconfined by SELinux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="selinux_confinement_of_daemons" source="ssg"/>
            <oval-def:description>All pids in /proc should be assigned an SELinux security context other than 'unconfined_service_t'.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="no unconfined_service_t in /proc" test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-selinux_not_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux is Not Disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="selinux_not_disabled" source="ssg"/>
            <oval-def:description>SELinux is not Disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="SELinux is not disabled" test_ref="oval:ssg-test_selinux_not_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-selinux_policytype:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SELinux Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="selinux_policytype" source="ssg"/>
            <oval-def:description>The SELinux policy should be set appropriately.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-selinux_state:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux State is Enforcing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="selinux_state" source="ssg"/>
            <oval-def:description>The SELinux state should be enforcing the local policy.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="enforce is disabled" test_ref="oval:ssg-test_etc_selinux_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-prefer_64bit_os:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prefer to use a 64-bit Operating System when supported</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="prefer_64bit_os" source="ssg"/>
            <oval-def:description>Check if the system supports a 64-bit Operating System</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Either the OS is 64-bit, or the CPU doesn't support 64-bit (it is 32 or 16 bit)" operator="OR">
            <oval-def:criteria comment="Either check osrelease in procfs, or kernel package arch parameter" operator="OR">
              <oval-def:criterion comment="Check if OS is 64-bit" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1"/>
              <oval-def:criterion comment="Check kernel rpm is x86_64" test_ref="oval:ssg-test_package_kernel_x64:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion negate="true" comment="Check if CPU is not 64-bit" test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_db_up_to_date:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_db_up_to_date" source="ssg"/>
            <oval-def:description>Make sure that the dconf databases are up-to-date with regards to respective keyfiles.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="AND">
              <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="OR">
                <oval-def:criterion comment="local database is up-to-date wrt keyfiles" test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1"/>
                <oval-def:criterion comment="no keyfiles applicable to the local database" test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-enable_dconf_user_profile:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure GNOME3 DConf User Profile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="enable_dconf_user_profile" source="ssg"/>
            <oval-def:description>The DConf User profile should have the local DB configured.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criterion comment="dconf user profile exists" test_ref="oval:ssg-test_dconf_user_profile:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the GNOME3 Login Restart and Shutdown Buttons</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_disable_restart_shutdown" source="ssg"/>
            <oval-def:description>Disable the GNOME3 Login GUI Restart and Shutdown buttons to all users on the login screen.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Disable GUI shutdown and restart buttons and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable restart and shutdown buttons" test_ref="oval:ssg-test_disable_restart_buttons:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_disable_user_list:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the GNOME3 Login User List</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_disable_user_list" source="ssg"/>
            <oval-def:description>Disable the GNOME3 GUI listing of all known users on the login screen.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Disable GUI listing of known users and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable user list" test_ref="oval:ssg-test_disable_user_list:tst:1"/>
              <oval-def:criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable GDM Automatic Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="gnome_gdm_disable_automatic_login" source="ssg"/>
            <oval-def:description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1"/>
            <oval-def:criterion comment="Disable GDM Automatic Login" test_ref="oval:ssg-test_disable_automatic_login:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable XDMCP in GDM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="gnome_gdm_disable_xdmcp" source="ssg"/>
            <oval-def:description>Ensure 'Enable' is configured with value 'false in section 'xdmcp' in /etc/gdm/custom.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="gdm is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="gdm is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the Enable in /etc/gdm/custom.conf" test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp" test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_disable_automount:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 automount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_disable_automount" source="ssg"/>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount within GNOME3.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Disable GNOME3 automount and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable automount in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing automount setting" test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_disable_automount_open:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 automount-open</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_disable_automount_open" source="ssg"/>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable automount-open within GNOME3.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable automount-open in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing automount-open setting" test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_disable_autorun:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 autorun</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_disable_autorun" source="ssg"/>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable autorun within GNOME3.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Disable GNOME3 autorun and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable autorun in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing autorun setting" test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Require Credential Prompting for Remote Access in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_remote_access_credential_prompt" source="ssg"/>
            <oval-def:description>Configure GNOME3 to require credential prompting for remote access.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="configure remote access credentials" test_ref="oval:ssg-test_configure_remote_access_creds:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Require Encryption for Remote Access in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_remote_access_encryption" source="ssg"/>
            <oval-def:description>Configure GNOME3 to require encryption for remote access connections.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="configure remote access encryption" test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Screensaver Idle Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_activation_enabled" source="ssg"/>
            <oval-def:description>Idle activation of the screen saver should be enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="check screensaver idle activation and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="idle activation has been configured" test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set GNOME3 Screensaver Inactivity Timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_delay" source="ssg"/>
            <oval-def:description>The allowed period of inactivity before the screensaver is activated.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="idle delay has been configured" test_ref="oval:ssg-test_screensaver_idle_delay:tst:1"/>
              <oval-def:criterion comment="idle delay is set correctly" test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set GNOME3 Screensaver Lock Delay After Activation Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_delay" source="ssg"/>
            <oval-def:description>Idle activation of the screen lock should be enabled immediately or
      after a delay.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock delay is configured" test_ref="oval:ssg-test_screensaver_lock_delay:tst:1"/>
              <oval-def:criterion comment="lock delay is set correctly" test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Screensaver Lock After Idle Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_enabled" source="ssg"/>
            <oval-def:description>Idle activation of the screen lock should be enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock is enabled" test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1"/>
              <oval-def:criterion comment="screensaver lock prevent user from changing" test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Implement Blank Screensaver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_screensaver_mode_blank" source="ssg"/>
            <oval-def:description>The GNOME3 screensaver should be blank.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="Enable blank screensaver and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver is blank" test_ref="oval:ssg-test_screensaver_mode_blank:tst:1"/>
              <oval-def:criterion comment="screensaver prevent user from changing mode" test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_screensaver_user_locks" source="ssg"/>
            <oval-def:description>Ensure that users cannot change GNOME3 screensaver idle and lock settings.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_session_idle_user_locks" source="ssg"/>
            <oval-def:description>Ensure that users cannot change GNOME3 session idle settings.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_disable_ctrlaltdel_reboot" source="ssg"/>
            <oval-def:description>Disable the GNOME3 ctrl-alt-del reboot key sequence in GNOME3.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable Ctrl-Alt-Del" test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_FIPS_certified:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The Installed Operating System Is FIPS 140-2 Certified</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="installed_OS_is_FIPS_certified" source="ssg"/>
            <oval-def:description>
          The operating system installed on the system is a certified operating system that meets FIPS 140-2 requirements.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Installed operating system is a certified operating system" operator="OR">
            <oval-def:extend_definition comment="Installed OS is RHEL8" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHCOS4" definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL7" definition_ref="oval:ssg-installed_OS_is_ol7:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL8" definition_ref="oval:ssg-installed_OS_is_ol8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL9" definition_ref="oval:ssg-installed_OS_is_ol9:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE12" definition_ref="oval:ssg-installed_OS_is_sle12:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE15" definition_ref="oval:ssg-installed_OS_is_sle15:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE Micro 5" definition_ref="oval:ssg-installed_OS_is_slmicro5:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 16.04" definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 18.04" definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 20.04" definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_vendor_supported:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The Installed Operating System Is Vendor Supported</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="installed_OS_is_vendor_supported" source="ssg"/>
            <oval-def:description>
        The operating system installed on the system is supported by a vendor that provides security patches.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Installed operating system is supported by a vendor" operator="OR">
            <oval-def:extend_definition comment="Installed OS is RHEL8" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHEL9" definition_ref="oval:ssg-installed_OS_is_rhel9:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL7" definition_ref="oval:ssg-installed_OS_is_ol7:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL8" definition_ref="oval:ssg-installed_OS_is_ol8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL9" definition_ref="oval:ssg-installed_OS_is_ol9:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE12" definition_ref="oval:ssg-installed_OS_is_sle12:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE15" definition_ref="oval:ssg-installed_OS_is_sle15:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE Micro 5" definition_ref="oval:ssg-installed_OS_is_slmicro5:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_bind_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure BIND to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_bind_crypto_policy" source="ssg"/>
            <oval-def:description>BIND should be configured to use the system-wide crypto policy setting.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if package bind is not installed" definition_ref="oval:ssg-package_bind_removed:def:1"/>
            <oval-def:criterion comment="Check that the configuration includes the policy config file." test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure System Cryptography Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_crypto_policy" source="ssg"/>
            <oval-def:description>Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/config" test_ref="oval:ssg-test_configure_crypto_policy:tst:1"/>
            <oval-def:criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/state/current" test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1"/>
            <oval-def:criterion comment="Check if update-crypto-policies has been run after config update" test_ref="oval:ssg-test_crypto_policies_updated:tst:1"/>
            <oval-def:criterion comment="Check if /etc/crypto-policies/back-ends/nss.config exists" test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_kerberos_crypto_policy:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Kerberos to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_kerberos_crypto_policy" source="ssg"/>
            <oval-def:description>Kerberos should be configured to use the system-wide crypto policy setting.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The config file is always a symlink to the backend, but the backend itself may be either a file, or a symlink. For this reason, we need two tests, if one passes, the other one is expected to either fail, or error." operator="OR">
            <oval-def:criterion comment="kerberos crypto-policy configuration links to same file as kerberos crypto-policy backend" test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1"/>
            <oval-def:criterion comment="kerberos crypto-policy configuration links to the crypto-policy backend file" test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_libreswan_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Libreswan to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_libreswan_crypto_policy" source="ssg"/>
            <oval-def:description>Libreswan should be configured to use the system-wide crypto policy setting.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition negate="true" comment="Check if package libreswan is not installed" definition_ref="oval:ssg-package_libreswan_installed:def:1"/>
            <oval-def:criterion comment="Check that the libreswan configuration includes the crypto policy config file" test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_openssl_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure OpenSSL library to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_openssl_crypto_policy" source="ssg"/>
            <oval-def:description>OpenSSL should be configured to use the system-wide crypto policy setting.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check that the configuration mandates usage of system-wide crypto policies." test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-configure_ssh_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSH to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="configure_ssh_crypto_policy" source="ssg"/>
            <oval-def:description>SSH should be configured to use the system-wide crypto policy setting.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check that the SSH configuration mandates usage of system-wide crypto policies." test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-harden_ssh_client_crypto_policy:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden SSH client Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="harden_ssh_client_crypto_policy" source="ssg"/>
            <oval-def:description>Ensure the ssh client ciphers are configured correctly in /etc/ssh/ssh_config.d/02-ospp.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH client is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the Match in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1"/>
            <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1"/>
            <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1"/>
            <oval-def:criterion comment="Check the Ciphers in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1"/>
            <oval-def:criterion comment="Check the PubkeyAcceptedKeyTypes in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1"/>
            <oval-def:criterion comment="Check the MACs in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1"/>
            <oval-def:criterion comment="Check the KexAlgorithms in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Client to Use FIPS 140 Validated Ciphers: openssh.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="harden_sshd_ciphers_openssh_conf_crypto_policy" source="ssg"/>
            <oval-def:description>Limit the Ciphers to those which are FIPS-approved.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus." operator="AND">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD Ciphers" test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="harden_sshd_ciphers_opensshserver_conf_crypto_policy" source="ssg"/>
            <oval-def:description>Limit the Ciphers to those which are FIPS-approved.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus." operator="AND">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/opensshserver.config contains FIPS-approved SSHD Ciphers" test_ref="oval:ssg-test_harden_sshd_ciphers_opensshserver_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="harden_sshd_macs_openssh_conf_crypto_policy" source="ssg"/>
            <oval-def:description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus." operator="AND">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD MACs" test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="harden_sshd_macs_opensshserver_conf_crypto_policy" source="ssg"/>
            <oval-def:description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus." operator="AND">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/opensshserver.config contains FIPS-approved SSHD MACs" test_ref="oval:ssg-test_harden_sshd_macs_opensshserver_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-agent_mfetpd_running:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure McAfee Endpoint Security for Linux (ENSL) is running</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="agent_mfetpd_running" source="ssg"/>
            <oval-def:description>Ensure that McAfee Endpoint Security for Linux (ENSL) is running.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="McAfee ENSL is running" test_ref="oval:ssg-test_agent_mfetpd_running:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-enable_dracut_fips_module:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Dracut FIPS Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="enable_dracut_fips_module" source="ssg"/>
            <oval-def:description>fips module should be enabled in Dracut configuration</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="dracut fips module is enabled" test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-enable_fips_mode:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable FIPS Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="enable_fips_mode" source="ssg"/>
            <oval-def:description>Check if FIPS mode is enabled on the system</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check contents of /proc/sys/crypto/fips_enabled" test_ref="oval:ssg-test_proc_sys_crypto_fips_enabled:tst:1"/>
            <oval-def:extend_definition comment="check option crypto.fips_enabled = 1 in sysctl" definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1"/>
            <oval-def:extend_definition comment="dracut FIPS module is enabled" definition_ref="oval:ssg-enable_dracut_fips_module:def:1"/>
            <oval-def:extend_definition comment="system cryptography policy is configured" definition_ref="oval:ssg-configure_crypto_policy:def:1"/>
            <oval-def:criterion comment="check if var_system_crypto_policy variable selection is set to FIPS" test_ref="oval:ssg-test_system_crypto_policy_value:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:extend_definition comment="generic test for s390x architecture" definition_ref="oval:ssg-system_info_architecture_s390_64:def:1"/>
                <oval-def:criterion comment="check if kernel option fips=1 is present in /boot/loader/entries/.*.conf" test_ref="oval:ssg-test_fips_1_argument_in_boot_loader_entries_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND">
                <oval-def:criteria negate="true" operator="AND">
                  <oval-def:extend_definition comment="generic test for non-s390x architecture" definition_ref="oval:ssg-system_info_architecture_s390_64:def:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="check if kernel option fips=1 is present in /boot/loader/entries/.*.conf" test_ref="oval:ssg-test_fips_1_argument_in_boot_loader_entries_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-etc_system_fips_exists:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure '/etc/system-fips' exists</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="etc_system_fips_exists" source="ssg"/>
            <oval-def:description>Check /etc/system-fips exists</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/etc/system-fips exists" test_ref="oval:ssg-test_etc_system_fips:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set kernel parameter 'crypto.fips_enabled' to 1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_crypto_fips_enabled" source="ssg"/>
            <oval-def:description>The kernel 'crypto.fips_enabled' parameter should be set to '1' in system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter crypto.fips_enabled set to 1" test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_build_database:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Build and Test AIDE Database</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_build_database" source="ssg"/>
            <oval-def:description>The aide database must be initialized.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_check_audit_tools:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure AIDE to Verify the Audit Tools</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_check_audit_tools" source="ssg"/>
            <oval-def:description>The Oracle Linux 9 operating system file integrity tool must be configured to protect the integrity of the audit tools.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion comment="auditctl is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_auditctl:tst:1"/>
            <oval-def:criterion comment="auditd is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_auditd:tst:1"/>
            <oval-def:criterion comment="ausearch is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_ausearch:tst:1"/>
            <oval-def:criterion comment="aureport is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_aureport:tst:1"/>
            <oval-def:criterion comment="autrace is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_autrace:tst:1"/>
            <oval-def:criterion comment="rsyslogd is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_rsyslogd:tst:1"/>
            <oval-def:criterion comment="augenrules is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_augenrules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_periodic_cron_checking:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Periodic Execution of AIDE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_periodic_cron_checking" source="ssg"/>
            <oval-def:description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_crond_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_var_cron_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron.(daily|weekly)" test_ref="oval:ssg-test_aide_crontabs_checking:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_scan_notification:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Notification of Post-AIDE Scan Details</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_scan_notification" source="ssg"/>
            <oval-def:description>AIDE should notify appropriate personnel of the details
      of a scan after the scan has been run.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="notify personnel when aide completes" test_ref="oval:ssg-test_aide_scan_notification:tst:1"/>
              <oval-def:criterion comment="notify personnel when aide completes" test_ref="oval:ssg-test_aide_var_cron_notification:tst:1"/>
              <oval-def:criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" test_ref="oval:ssg-test_aide_crontabs_notification:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_use_fips_hashes:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure AIDE to Use FIPS 140-2 for Validating Hashes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_use_fips_hashes" source="ssg"/>
            <oval-def:description>AIDE should be configured to use the FIPS 140-2 
      cryptographic hashes.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is FIPS certified" definition_ref="oval:ssg-installed_OS_is_FIPS_certified:def:1"/>
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion comment="non-FIPS hashes are not configured" test_ref="oval:ssg-test_aide_non_fips_hashes:tst:1"/>
            <oval-def:criterion comment="FIPS hashes are configured" test_ref="oval:ssg-test_aide_use_fips_hashes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_verify_acls:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure AIDE to Verify Access Control Lists (ACLs)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_verify_acls" source="ssg"/>
            <oval-def:description>AIDE should be configured to verify Access Control Lists (ACLs).</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion comment="acl is set in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_acls:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-aide_verify_ext_attributes:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure AIDE to Verify Extended Attributes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="aide_verify_ext_attributes" source="ssg"/>
            <oval-def:description>AIDE should be configured to verify extended file attributes.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion comment="xattrs is set in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_ext_attributes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rpm_verify_hashes:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify File Hashes with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rpm_verify_hashes" source="ssg"/>
            <oval-def:description>Verify the RPM digests of system binaries using the RPM database.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="verify file md5 hashes" test_ref="oval:ssg-test_rpm_verify_hashes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rpm_verify_ownership:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify and Correct Ownership with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rpm_verify_ownership" source="ssg"/>
            <oval-def:description>Verify ownership of installed packages by comparing the installed files
      with information about the files taken from the package metadata stored in the RPM
      database.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="user ownership of all files matches local rpm database" test_ref="oval:ssg-test_rpm_verify_ownership_verify_all_rpms_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rpm_verify_permissions:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify and Correct File Permissions with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rpm_verify_permissions" source="ssg"/>
            <oval-def:description>Verify the permissions of installed packages by comparing the installed
        files with information about the files taken from the package metadata stored in the RPM
        database.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="mode of all files matches local rpm database" test_ref="oval:ssg-test_rpm_verify_permissions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_dedicated_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure a dedicated group owns sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_dedicated_group" source="ssg"/>
            <oval-def:description>This test makes sure that /usr/bin/sudo is owned by the group set in var_sudo_dedicated_group</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if dedicated group exists" test_ref="oval:ssg-test_dedicated_group_exists:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/bin/sudo" test_ref="oval:ssg-test_sudo_owned_by_dedicated_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_remove_no_authenticate:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_remove_no_authenticate" source="ssg"/>
            <oval-def:description>Checks sudo usage without authentication</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="!authenticate does not exist in /etc/sudoers" test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="!authenticate does not exist in /etc/sudoers.d" test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_remove_nopasswd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_remove_nopasswd" source="ssg"/>
            <oval-def:description>Checks sudo usage without password</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NOPASSWD is not configured in /etc/sudoers" test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="NOPASSWD is not configured in /etc/sudoers.d" test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_require_authentication:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_require_authentication" source="ssg"/>
            <oval-def:description>Checks sudo usage without password</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1"/>
            <oval-def:extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_require_reauthentication:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Require Re-Authentication When Using the sudo Command</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_require_reauthentication" source="ssg"/>
            <oval-def:description>'Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The timestamp_timeout should be configured" operator="AND">
            <oval-def:criterion comment="check configuration in /etc/sudoers" test_ref="oval:ssg-test_sudo_timestamp_timeout:tst:1"/>
            <oval-def:criterion comment="check for - sign in configuration" test_ref="oval:ssg-test_sudo_timestamp_timeout_no_signs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_restrict_privilege_elevation_to_authorized:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The operating system must restrict privilege elevation to authorized personnel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_restrict_privilege_elevation_to_authorized" source="ssg"/>
            <oval-def:description>Check that sudoers doesn't allow all users to run commands via sudo</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that sudoers has restrictions on which users can run sudo for any target user" test_ref="oval:ssg-test_not_all_users_can_sudo_to_users:tst:1"/>
            <oval-def:criterion comment="Make sure that sudoers has restrictions on which users can run sudo for any target group" test_ref="oval:ssg-test_not_all_users_can_sudo_to_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_vdsm_nopasswd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Only the VDSM User Can Use sudo NOPASSWD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_vdsm_nopasswd" source="ssg"/>
            <oval-def:description>Checks sudo usage for the vdsm user without a password</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NOPASSWD only exists for vdsm user in /etc/sudoers" test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d" test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudoers_explicit_command_args:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Explicit arguments in sudo specifications</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudoers_explicit_command_args" source="ssg"/>
            <oval-def:description>Check that sudoers doesn't contain commands without arguments specified</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no commands are without arguments" test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudoers_no_command_negation:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Don't define allowed commands in sudoers by means of exclusion</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudoers_no_command_negation" source="ssg"/>
            <oval-def:description>Check that sudoers doesn't contain command negations</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no command in user spec contains negation" test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudoers_no_root_target:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Don't target root user in the sudoers file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudoers_no_root_target" source="ssg"/>
            <oval-def:description>Check that sudoers doesn't allow users to run commands as root</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL" test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1"/>
            <oval-def:criterion comment="Make sure that all user specs in sudoers feature a runas spec" test_ref="oval:ssg-test_no_user_spec_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudoers_validate_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure invoking users password for privilege escalation when using sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudoers_validate_passwd" source="ssg"/>
            <oval-def:description>Ensure invoking user's password for privilege escalation when using sudo</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check Defaults !targetpw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults !rootpw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults !runaspw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults targetpw is not defined in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_targetpw_not_defined:tst:1"/>
            <oval-def:criterion comment="Check Defaults rootpw is not defined in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_rootpw_not_defined:tst:1"/>
            <oval-def:criterion comment="Check Defaults runaspw is not defined in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_runaspw_not_defined:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-clean_components_post_updating:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure yum Removes Previous Package Versions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="clean_components_post_updating" source="ssg"/>
            <oval-def:description>The clean_requirements_on_remove option should be used to ensure that old
      versions of software components are removed after updating.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value of clean_requirements_on_remove in /etc/yum.conf" test_ref="oval:ssg-test_yum_clean_components_post_updating:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dnf-automatic_apply_updates:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure dnf-automatic to Install Available Updates Automatically</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dnf-automatic_apply_updates" source="ssg"/>
            <oval-def:description>Ensure 'apply_updates' is configured with value 'yes in section 'commands' in /etc/dnf/automatic.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="dnf-automatic is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="dnf-automatic is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the apply_updates in /etc/dnf/automatic.conf" test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates" test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dnf-automatic_security_updates_only:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure dnf-automatic to Install Only Security Updates</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dnf-automatic_security_updates_only" source="ssg"/>
            <oval-def:description>Ensure 'upgrade_type' is configured with value 'security in section 'commands' in /etc/dnf/automatic.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="dnf-automatic is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="dnf-automatic is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the upgrade_type in /etc/dnf/automatic.conf" test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only" test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled In Main yum Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_gpgcheck_globally_activated" source="ssg"/>
            <oval-def:description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_gpgcheck_local_packages:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for Local Packages</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_gpgcheck_local_packages" source="ssg"/>
            <oval-def:description>The localpkg_gpgcheck option should be used to ensure that checking 
      of an RPM package's signature always occurs prior to its
      installation.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value of localpkg_gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for All yum Package Repositories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_gpgcheck_never_disabled" source="ssg"/>
            <oval-def:description>Ensure all yum or dnf repositories utilize signature checking.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="ensure all yum or dnf repositories utilize signiature checking" operator="AND">
            <oval-def:criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files" test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ensure_oracle_gpgkey_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Oracle Linux GPG Key Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="ensure_oracle_gpgkey_installed" source="ssg"/>
            <oval-def:description>The Oracle Linux key packages are required to be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Oracle Vendor Keys" operator="AND">
            <oval-def:criteria comment="Oracle Installed" operator="OR">
              <oval-def:extend_definition comment="ol9 installed" definition_ref="oval:ssg-installed_OS_is_ol9:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="Oracle Vendor Keys Installed" operator="OR">
              <oval-def:criterion comment="package gpg-pubkey-8d8b756f-629e59ec is installed" test_ref="oval:ssg-test_oracle_package_gpgkey-8d8b756f-629e59ec_installed:tst:1"/>
              <oval-def:criterion comment="package gpg-pubkey-8b4efbe6-629ec292 is installed" test_ref="oval:ssg-test_oracle_package_gpgkey-8b4efbe6-629ec292_installed:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_dcredit:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_dcredit" source="ssg"/>
            <oval-def:description>The password dcredit should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for dcredit are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="dcredit is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_dcredit_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_dictcheck:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_dictcheck" source="ssg"/>
            <oval-def:description>The password dictcheck should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for dictcheck are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="dictcheck is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_dictcheck_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_difok:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_difok" source="ssg"/>
            <oval-def:description>The password difok should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for difok are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="difok is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_difok_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_lcredit:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_lcredit" source="ssg"/>
            <oval-def:description>The password lcredit should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for lcredit are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="lcredit is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_lcredit_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_maxclassrepeat" source="ssg"/>
            <oval-def:description>The password maxclassrepeat should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for maxclassrepeat are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="maxclassrepeat is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Password Maximum Consecutive Repeating Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_maxrepeat" source="ssg"/>
            <oval-def:description>The password maxrepeat should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for maxrepeat are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="maxrepeat is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_minclass:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_minclass" source="ssg"/>
            <oval-def:description>The password minclass should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for minclass are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="minclass is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_minclass_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_minlen:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Length</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_minlen" source="ssg"/>
            <oval-def:description>The password minlen should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for minlen are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="minlen is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_minlen_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_ocredit:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_ocredit" source="ssg"/>
            <oval-def:description>The password ocredit should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for ocredit are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="ocredit is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_ocredit_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_ucredit:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_ucredit" source="ssg"/>
            <oval-def:description>The password ucredit should meet minimum requirements</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="conditions for ucredit are satisfied" operator="AND">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="ucredit is not overwritten in system-auth" test_ref="oval:ssg-test_password_pam_pwquality_ucredit_not_overwritten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="6" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Lock Accounts After Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_deny" source="ssg"/>
            <oval-def:description>Lockout account after failed login attempts.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check the proper configuration of pam_faillock.so" operator="AND">
            <oval-def:criteria comment="Check if pam_faillock.so is properly enabled" operator="AND">
              <oval-def:criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth" operator="AND">
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1"/>
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check common definition of pam_faillock.so" operator="AND">
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected value for pam_faillock.so deny parameter" operator="OR">
              <oval-def:criteria comment="Check expected pam_faillock.so deny parameter in pam files" operator="AND">
                <oval-def:criterion comment="Check the deny parameter in auth section of system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the deny parameter in auth section of password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the deny parameter is not present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check expected pam_faillock.so deny parameter in faillock.conf" operator="AND">
                <oval-def:criterion comment="Check the deny parameter is not present system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the deny parameter is not present password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the deny parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="6" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Interval For Counting Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_interval" source="ssg"/>
            <oval-def:description>The number of allowed failed logins should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check the proper configuration of pam_faillock.so" operator="AND">
            <oval-def:criteria comment="Check if pam_faillock.so is properly enabled" operator="AND">
              <oval-def:criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth" operator="AND">
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_unix_auth:tst:1"/>
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_unix_auth:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check common definition of pam_faillock.so" operator="AND">
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_account:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_account:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected value for pam_faillock.so fail_interval parameter" operator="OR">
              <oval-def:criteria comment="Check expected pam_faillock.so fail_interval parameter in pam files" operator="AND">
                <oval-def:criterion comment="Check the fail_interval parameter in auth section of system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the fail_interval parameter in auth section of password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the fail_interval parameter is not present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_faillock_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check expected pam_faillock.so fail_interval parameter in faillock.conf" operator="AND">
                <oval-def:criterion comment="Check the fail_interval parameter is not present system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the fail_interval parameter is not present password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the fail_interval parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="6" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Lockout Time for Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_unlock_time" source="ssg"/>
            <oval-def:description>The unlock time after number of failed logins should be set correctly.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check the proper configuration of pam_faillock.so" operator="AND">
            <oval-def:criteria comment="Check if pam_faillock.so is properly enabled" operator="AND">
              <oval-def:criteria comment="Count occurrences of pam_unix.so in system-auth and password-auth" operator="AND">
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1"/>
                <oval-def:criterion comment="pam_unix.so appears only once in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check common definition of pam_faillock.so" operator="AND">
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in auth section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1"/>
                <oval-def:criterion comment="pam_faillock.so is properly defined in account section of password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria comment="Check expected value for pam_faillock.so unlock_time parameter" operator="OR">
              <oval-def:criteria comment="Check expected pam_faillock.so unlock_time parameter in pam files" operator="AND">
                <oval-def:criterion comment="Check the unlock_time parameter in auth section of system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the unlock_time parameter in auth section of password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the unlock_time parameter is not present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Check expected pam_faillock.so unlock_time parameter in faillock.conf" operator="AND">
                <oval-def:criterion comment="Check the unlock_time parameter is not present system-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1"/>
                <oval-def:criterion comment="Check the unlock_time parameter is not present password-auth file" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1"/>
                <oval-def:criterion comment="Ensure the unlock_time parameter is present in /etc/security/faillock.conf" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_access_failed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of unsuccessful file accesses</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_access_failed" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_access_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_access_success:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of successful file accesses</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_access_success" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-3-access-success.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_access_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_basic_configuration:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure basic parameters of Audit system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_basic_configuration" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/10-base-config.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_basic_configuration_test_whole_file_contents_tc_audit_rules_d_10_base_config_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_create_failed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of unsuccessful file creations</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_create_failed" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_create_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_create_success:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of successful file creations</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_create_success" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-1-create-success.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_create_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_delete_failed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of unsuccessful file deletions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_delete_failed" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_delete_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_delete_success:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of successful file deletions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_delete_success" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_delete_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_immutable_login_uids:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure immutable Audit login UIDs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_immutable_login_uids" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/11-loginuid.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_immutable_login_uids_test_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_modify_failed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of unsuccessful file modifications</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_modify_failed" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_modify_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_modify_success:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of successful file modifications</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_modify_success" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_modify_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_module_load:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_module_load" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/43-module-load.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_module_load_test_whole_file_contents_tc_audit_rules_d_43_module_load_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_ospp_general:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Perform general configuration of Audit for OSPP</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_ospp_general" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_ospp_general_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_owner_change_failed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of unsuccessful ownership changes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_owner_change_failed" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_owner_change_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_owner_change_success:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of successful ownership changes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_owner_change_success" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_owner_change_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_perm_change_failed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of unsuccessful permission changes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_perm_change_failed" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_perm_change_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_perm_change_success:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure auditing of successful permission changes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_perm_change_success" source="ssg"/>
            <oval-def:description>Inspect the contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check contents of file" test_ref="oval:ssg-audit_perm_change_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_privileged_commands_init:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - init</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_privileged_commands_init" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of init is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules init" test_ref="oval:ssg-test_audit_privileged_commands_init_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl init" test_ref="oval:ssg-test_audit_privileged_commands_init_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_privileged_commands_poweroff:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - poweroff</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_privileged_commands_poweroff" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of poweroff is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules poweroff" test_ref="oval:ssg-test_audit_privileged_commands_poweroff_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl poweroff" test_ref="oval:ssg-test_audit_privileged_commands_poweroff_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_privileged_commands_reboot:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - reboot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_privileged_commands_reboot" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of reboot is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules reboot" test_ref="oval:ssg-test_audit_privileged_commands_reboot_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl reboot" test_ref="oval:ssg-test_audit_privileged_commands_reboot_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_privileged_commands_shutdown:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - shutdown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_privileged_commands_shutdown" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of shutdown is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules shutdown" test_ref="oval:ssg-test_audit_privileged_commands_shutdown_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl shutdown" test_ref="oval:ssg-test_audit_privileged_commands_shutdown_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - chmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_chmod" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_chown" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchmod" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchmodat" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchown" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchownat" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_fremovexattr" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_fsetxattr" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_lchown" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_lremovexattr" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_lsetxattr" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_removexattr" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_setxattr" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_dac_modification_umount2:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - umount2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_dac_modification_umount2" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit umount2" test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit umount2" test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit umount2" test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit umount2" test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_chacl:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run chacl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_chacl" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of chacl is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chacl" test_ref="oval:ssg-test_audit_rules_execution_chacl_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chacl" test_ref="oval:ssg-test_audit_rules_execution_chacl_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_chcon:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run chcon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_chcon" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of chcon is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chcon" test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chcon" test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_restorecon:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run restorecon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_restorecon" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of restorecon is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules restorecon" test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl restorecon" test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_semanage:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_semanage" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of semanage is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules semanage" test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl semanage" test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_setfacl:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run setfacl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_setfacl" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of setfacl is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules setfacl" test_ref="oval:ssg-test_audit_rules_execution_setfacl_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl setfacl" test_ref="oval:ssg-test_audit_rules_execution_setfacl_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_setfiles:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run setfiles</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_setfiles" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of setfiles is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules setfiles" test_ref="oval:ssg-test_audit_rules_execution_setfiles_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl setfiles" test_ref="oval:ssg-test_audit_rules_execution_setfiles_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_setsebool:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run setsebool</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_setsebool" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of setsebool is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules setsebool" test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl setsebool" test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_execution_seunshare:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run seunshare</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_execution_seunshare" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of seunshare is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules seunshare" test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl seunshare" test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - rename</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_rename" source="ssg"/>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit rename" test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit rename" test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit rename" test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit rename" test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - renameat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_renameat" source="ssg"/>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit renameat" test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit renameat" test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit renameat" test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit renameat" test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - rmdir</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_rmdir" source="ssg"/>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit rmdir" test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit rmdir" test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit rmdir" test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit rmdir" test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - unlink</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_unlink" source="ssg"/>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit unlink" test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit unlink" test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit unlink" test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit unlink" test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - unlinkat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_unlinkat" source="ssg"/>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit unlinkat" test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit unlinkat" test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit unlinkat" test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit unlinkat" test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_login_events_faillock:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - faillock</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_login_events_faillock" source="ssg"/>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules var_accounts_passwords_pam_faillock_dir" test_ref="oval:ssg-test_arle_var_accounts_passwords_pam_faillock_dir_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl var_accounts_passwords_pam_faillock_dir" test_ref="oval:ssg-test_arle_var_accounts_passwords_pam_faillock_dir_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - lastlog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_login_events_lastlog" source="ssg"/>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules lastlog" test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl lastlog" test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - tallylog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_login_events_tallylog" source="ssg"/>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules tallylog" test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl tallylog" test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_media_export:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Exporting to Media (successful)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_media_export" source="ssg"/>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit mount" test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit mount" test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit mount" test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit mount" test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_at:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_at" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of at is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules at" test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl at" test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_chage:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_chage" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of chage is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chage" test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chage" test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_chsh" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of chsh is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chsh" test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chsh" test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_crontab" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of crontab is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules crontab" test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl crontab" test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_gpasswd" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of gpasswd is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules gpasswd" test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl gpasswd" test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_kmod:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - kmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_kmod" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of kmod is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules kmod" test_ref="oval:ssg-test_audit_rules_privileged_commands_kmod_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl kmod" test_ref="oval:ssg-test_audit_rules_privileged_commands_kmod_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_mount:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_mount" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of mount is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules mount" test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl mount" test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newgrp" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of newgrp is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newgrp" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newgrp" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_pam_timestamp_check:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_pam_timestamp_check" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of pam_timestamp_check is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules pam_timestamp_check" test_ref="oval:ssg-test_audit_rules_privileged_commands_pam_timestamp_check_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl pam_timestamp_check" test_ref="oval:ssg-test_audit_rules_privileged_commands_pam_timestamp_check_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_passwd" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of passwd is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules passwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl passwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_postdrop:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - postdrop</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_postdrop" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of postdrop is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules postdrop" test_ref="oval:ssg-test_audit_rules_privileged_commands_postdrop_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl postdrop" test_ref="oval:ssg-test_audit_rules_privileged_commands_postdrop_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_postqueue:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - postqueue</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_postqueue" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of postqueue is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules postqueue" test_ref="oval:ssg-test_audit_rules_privileged_commands_postqueue_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl postqueue" test_ref="oval:ssg-test_audit_rules_privileged_commands_postqueue_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_ssh_agent:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run ssh-agent</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_ssh_agent" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of ssh_agent is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules ssh_agent" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_agent_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl ssh_agent" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_agent_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_ssh_keysign" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of ssh_keysign is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules ssh_keysign" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl ssh_keysign" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_su:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_su" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of su is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules su" test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl su" test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_sudo" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of sudo is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudo" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudo" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_sudoedit" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of sudoedit is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoedit" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoedit" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_umount:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_umount" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of umount is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules umount" test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl umount" test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_unix_chkpwd" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of unix_chkpwd is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules unix_chkpwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl unix_chkpwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_unix_update:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_update</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_unix_update" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of unix_update is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules unix_update" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_update_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl unix_update" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_update_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_userhelper" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of userhelper is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules userhelper" test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl userhelper" test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_usermod:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - usermod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_usermod" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of usermod is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules usermod" test_ref="oval:ssg-test_audit_rules_privileged_commands_usermod_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl usermod" test_ref="oval:ssg-test_audit_rules_privileged_commands_usermod_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_privileged_commands_usernetctl" source="ssg"/>
            <oval-def:description>Audit rules about the information on the use of usernetctl is enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules usernetctl" test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl usernetctl" test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - creat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_creat" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - ftruncate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_ftruncate" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - open</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - openat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - truncate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_truncate" source="ssg"/>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_usergroup_modification_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_group" source="ssg"/>
            <oval-def:description>Audit user/group modification.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_gshadow" source="ssg"/>
            <oval-def:description>Audit user/group modification.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/security/opasswd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_opasswd" source="ssg"/>
            <oval-def:description>Audit user/group modification.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_passwd" source="ssg"/>
            <oval-def:description>Audit user/group modification.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_shadow" source="ssg"/>
            <oval-def:description>Audit user/group modification.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_sudo_log_events:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to perform maintenance activities</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_sudo_log_events" source="ssg"/>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudo_log" test_ref="oval:ssg-test_arle_sudo_log_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudo_log" test_ref="oval:ssg-test_arle_sudo_log_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_freq:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set number of records to cause an explicit flush to audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_freq" source="ssg"/>
            <oval-def:description>Ensure 'freq' is configured with value '50' in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the freq in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_freq:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_local_events:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Include Local Events in Audit Logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_local_events" source="ssg"/>
            <oval-def:description>Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the local_events in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_local_events:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_log_format:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Resolve information before writing to audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_log_format" source="ssg"/>
            <oval-def:description>Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the log_format in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_log_format:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_write_logs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Write Audit Logs to the Disk</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_write_logs" source="ssg"/>
            <oval-def:description>Ensure 'write_logs' is configured with value 'yes' in /etc/audit/auditd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the write_logs in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_write_logs:tst:1"/>
            <oval-def:criterion comment="Check the absence of write_logs in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the GNOME3 Screen Locking On Smartcard Removal</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dconf_gnome_lock_screen_on_smartcard_removal" source="ssg"/>
            <oval-def:description>Ensure 'removal-action' is configured with value ''lock-screen' in section 'org/gnome/settings-daemon/peripherals/smartcard' in /etc/dconf/db/local.d/</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="dconf is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the removal-action in /etc/dconf/db/local.d/" test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1"/>
            <oval-def:criterion comment="Prevent user from modifying removal-action" test_ref="oval:ssg-test_prevent_user_removal-action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_group_ownership_library_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Root Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_group_ownership_library_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /lib/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /lib64/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib64/" test_ref="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_ownership_binary_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executable Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_ownership_binary_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /bin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/bin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/sbin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/local/bin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/local/sbin/" test_ref="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_ownership_library_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_ownership_library_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /lib/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /lib64/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib64/" test_ref="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_permissions_binary_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executable Directories Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_permissions_binary_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /bin/, /sbin/, /usr/bin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/ has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /bin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/bin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/sbin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/local/bin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/local/sbin/" test_ref="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-dir_permissions_library_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="dir_permissions_library_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ has mode 7755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /lib/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /lib64/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib64/" test_ref="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_groupowner_etc_ipsecd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/ipsec.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_groupowner_etc_ipsecd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.d/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/ipsec.d/" test_ref="oval:ssg-test_file_groupownerdirectory_groupowner_etc_ipsecd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_groupowner_etc_iptables:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/iptables Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_groupowner_etc_iptables" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/iptables/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/iptables/" test_ref="oval:ssg-test_file_groupownerdirectory_groupowner_etc_iptables_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_groupowner_etc_nftables:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/nftables Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_groupowner_etc_nftables" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/nftables/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/nftables/" test_ref="oval:ssg-test_file_groupownerdirectory_groupowner_etc_nftables_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_groupowner_etc_selinux:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/selinux Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_groupowner_etc_selinux" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/selinux/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/selinux/" test_ref="oval:ssg-test_file_groupownerdirectory_groupowner_etc_selinux_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_groupowner_etc_sudoersd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/sudoers.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_groupowner_etc_sudoersd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sudoers.d/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/sudoers.d/" test_ref="oval:ssg-test_file_groupownerdirectory_groupowner_etc_sudoersd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_groupowner_etc_sysctld:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/sysctl.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_groupowner_etc_sysctld" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sysctl.d/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/sysctl.d/" test_ref="oval:ssg-test_file_groupownerdirectory_groupowner_etc_sysctld_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_owner_etc_ipsecd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/ipsec.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_owner_etc_ipsecd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.d/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/ipsec.d/" test_ref="oval:ssg-test_file_ownerdirectory_owner_etc_ipsecd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_owner_etc_iptables:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/iptables Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_owner_etc_iptables" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/iptables/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/iptables/" test_ref="oval:ssg-test_file_ownerdirectory_owner_etc_iptables_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_owner_etc_nftables:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/nftables Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_owner_etc_nftables" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/nftables/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/nftables/" test_ref="oval:ssg-test_file_ownerdirectory_owner_etc_nftables_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_owner_etc_selinux:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/selinux Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_owner_etc_selinux" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/selinux/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/selinux/" test_ref="oval:ssg-test_file_ownerdirectory_owner_etc_selinux_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_owner_etc_sudoersd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/sudoers.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_owner_etc_sudoersd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sudoers.d/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/sudoers.d/" test_ref="oval:ssg-test_file_ownerdirectory_owner_etc_sudoersd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_owner_etc_sysctld:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/sysctl.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_owner_etc_sysctld" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sysctl.d/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/sysctl.d/" test_ref="oval:ssg-test_file_ownerdirectory_owner_etc_sysctld_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_etc_ipsecd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/ipsec.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_etc_ipsecd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.d/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/ipsec.d/" test_ref="oval:ssg-test_file_permissionsdirectory_permissions_etc_ipsecd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_etc_iptables:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/iptables Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_etc_iptables" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/iptables/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/iptables/" test_ref="oval:ssg-test_file_permissionsdirectory_permissions_etc_iptables_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_etc_nftables:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/nftables Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_etc_nftables" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/nftables/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/nftables/" test_ref="oval:ssg-test_file_permissionsdirectory_permissions_etc_nftables_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_etc_selinux:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/selinux Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_etc_selinux" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/selinux/ has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/selinux/" test_ref="oval:ssg-test_file_permissionsdirectory_permissions_etc_selinux_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_etc_sudoersd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/sudoers.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_etc_sudoersd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sudoers.d/ has mode 0750.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/sudoers.d/" test_ref="oval:ssg-test_file_permissionsdirectory_permissions_etc_sudoersd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-directory_permissions_etc_sysctld:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/sysctl.d Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="directory_permissions_etc_sysctld" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sysctl.d/ has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/sysctl.d/" test_ref="oval:ssg-test_file_permissionsdirectory_permissions_etc_sysctld_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-disable_host_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Host-Based Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="disable_host_auth" source="ssg"/>
            <oval-def:description>Ensure 'HostbasedAuthentication' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the HostbasedAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_disable_host_auth:tst:1"/>
                  <oval-def:criterion comment="Check the HostbasedAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_disable_host_auth_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_HostbasedAuthentication_present_disable_host_auth:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_at_deny_not_exist:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that /etc/at.deny does not exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_at_deny_not_exist" source="ssg"/>
            <oval-def:description>This test makes sure that/etc/at.deny does not exist.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Ensure that /etc/at.deny does not exist." test_ref="oval:ssg-test_file_at_deny_not_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_audit_tools_group_ownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Audit Tools Must Be Group-owned by Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_audit_tools_group_ownership" source="ssg"/>
            <oval-def:description>This test makes sure that /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/rsyslogd, /sbin/augenrules is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /sbin/auditctl" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /sbin/aureport" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_1:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /sbin/ausearch" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_2:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /sbin/autrace" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_3:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /sbin/auditd" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_4:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /sbin/rsyslogd" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_5:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /sbin/augenrules" test_ref="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_audit_tools_ownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Audit Tools Must Be Owned by Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_audit_tools_ownership" source="ssg"/>
            <oval-def:description>This test makes sure that /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/rsyslogd, /sbin/augenrules is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /sbin/auditctl" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/aureport" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/ausearch" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/autrace" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_3:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/auditd" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_4:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/rsyslogd" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_5:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /sbin/augenrules" test_ref="oval:ssg-test_file_ownerfile_audit_tools_ownership_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_audit_tools_permissions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Audit Tools Must Have a Mode of 0755 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_audit_tools_permissions" source="ssg"/>
            <oval-def:description>This test makes sure that /sbin/auditctl, /sbin/aureport, /sbin/ausearch, /sbin/autrace, /sbin/auditd, /sbin/rsyslogd, /sbin/augenrules has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /sbin/auditctl" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/aureport" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/ausearch" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/autrace" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_3:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/auditd" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_4:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/rsyslogd" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_5:tst:1"/>
            <oval-def:criterion comment="Check file mode of /sbin/augenrules" test_ref="oval:ssg-test_file_permissionsfile_audit_tools_permissions_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_cron_deny_not_exist:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure that /etc/cron.deny does not exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_cron_deny_not_exist" source="ssg"/>
            <oval-def:description>This test makes sure that/etc/cron.deny does not exist.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Ensure that /etc/cron.deny does not exist." test_ref="oval:ssg-test_file_cron_deny_not_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_at_allow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/at.allow file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_at_allow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/at.allow is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/at.allow" test_ref="oval:ssg-test_file_groupowner_at_allow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_backup_etc_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_backup_etc_group" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/group- is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/group-" test_ref="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_backup_etc_gshadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/gshadow- is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/gshadow-" test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_backup_etc_passwd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/passwd- is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/passwd-" test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_backup_etc_shadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shadow- is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/shadow-" test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_allow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/cron.allow file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_allow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.allow is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.allow" test_ref="oval:ssg-test_file_groupowner_cron_allow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_d:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns cron.d</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_d" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.d/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.d/" test_ref="oval:ssg-test_file_groupowner_cron_d_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_daily:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns cron.daily</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_daily" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.daily/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.daily/" test_ref="oval:ssg-test_file_groupowner_cron_daily_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_deny:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns cron.deny</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_deny" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.deny is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.deny" test_ref="oval:ssg-test_file_groupowner_cron_deny_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_hourly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns cron.hourly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_hourly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.hourly/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.hourly/" test_ref="oval:ssg-test_file_groupowner_cron_hourly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_monthly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns cron.monthly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_monthly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.monthly/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.monthly/" test_ref="oval:ssg-test_file_groupowner_cron_monthly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_cron_weekly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns cron.weekly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_cron_weekly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.weekly/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/cron.weekly/" test_ref="oval:ssg-test_file_groupowner_cron_weekly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_crontab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Crontab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_crontab" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/crontab is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/crontab" test_ref="oval:ssg-test_file_groupowner_crontab_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_efi_grub2_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_efi_user_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/user.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_efi_user_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/user.cfg is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/user.cfg" test_ref="oval:ssg-test_file_groupowner_efi_user_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_crypttab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/crypttab File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_crypttab" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/crypttab is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/crypttab" test_ref="oval:ssg-test_file_groupowner_etc_crypttab_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_group" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/group is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/group" test_ref="oval:ssg-test_file_groupowner_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_gshadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/gshadow is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/gshadow" test_ref="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_ipsec_conf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/ipsec.conf File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_ipsec_conf" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.conf is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/ipsec.conf" test_ref="oval:ssg-test_file_groupowner_etc_ipsec_conf_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_ipsec_secrets:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/ipsec.secrets File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_ipsec_secrets" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.secrets is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/ipsec.secrets" test_ref="oval:ssg-test_file_groupowner_etc_ipsec_secrets_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_issue_net:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership of System Login Banner for Remote Connections</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_issue_net" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/issue.net is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/issue.net" test_ref="oval:ssg-test_file_groupowner_etc_issue_net_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_passwd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/passwd is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/passwd" test_ref="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_sestatus_conf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/sestatus.conf File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_sestatus_conf" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sestatus.conf is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/sestatus.conf" test_ref="oval:ssg-test_file_groupowner_etc_sestatus_conf_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_shadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shadow is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/shadow" test_ref="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_shells:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/shells File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_shells" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shells is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/shells" test_ref="oval:ssg-test_file_groupowner_etc_shells_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_etc_sudoers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /etc/sudoers File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_etc_sudoers" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sudoers is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/sudoers" test_ref="oval:ssg-test_file_groupowner_etc_sudoers_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_grub2_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_grub2_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_sshd_config:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns SSH Server config file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_sshd_config" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/sshd_config is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/ssh/sshd_config" test_ref="oval:ssg-test_file_groupowner_sshd_config_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_systemmap:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns System.map Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_systemmap" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/ is group owned by root.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /boot/" test_ref="oval:ssg-test_file_groupowner_systemmap_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_user_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/user.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_user_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/user.cfg is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/user.cfg" test_ref="oval:ssg-test_file_groupowner_user_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_var_log:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_var_log" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /var/log/" test_ref="oval:ssg-test_file_groupowner_var_log_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_var_log_messages:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_var_log_messages" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/messages is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /var/log/messages" test_ref="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupowner_var_log_syslog:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log/syslog File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupowner_var_log_syslog" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/syslog is group owned by 4.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /var/log/syslog" test_ref="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupownership_audit_configuration:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Audit Configuration Files Must Be Owned By Group root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupownership_audit_configuration" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/audit/, /etc/audit/rules.d/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/audit/" test_ref="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupownership_sshd_private_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership on SSH Server Private *_key Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupownership_sshd_private_key" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/ is group owned by ssh_keys.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/ssh/" test_ref="oval:ssg-test_file_groupownership_sshd_private_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_groupownership_sshd_pub_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership on SSH Server Public *.pub Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_groupownership_sshd_pub_key" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /etc/ssh/" test_ref="oval:ssg-test_file_groupownership_sshd_pub_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_backup_etc_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_backup_etc_group" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/group- is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/group-" test_ref="oval:ssg-test_file_owner_backup_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_backup_etc_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_backup_etc_gshadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/gshadow- is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/gshadow-" test_ref="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_backup_etc_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_backup_etc_passwd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/passwd- is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/passwd-" test_ref="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_backup_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_backup_etc_shadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shadow- is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/shadow-" test_ref="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_allow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/cron.allow file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_allow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.allow is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.allow" test_ref="oval:ssg-test_file_owner_cron_allow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_d:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on cron.d</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_d" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.d/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.d/" test_ref="oval:ssg-test_file_owner_cron_d_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_daily:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on cron.daily</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_daily" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.daily/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.daily/" test_ref="oval:ssg-test_file_owner_cron_daily_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_deny:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on cron.deny</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_deny" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.deny is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.deny" test_ref="oval:ssg-test_file_owner_cron_deny_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_hourly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on cron.hourly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_hourly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.hourly/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.hourly/" test_ref="oval:ssg-test_file_owner_cron_hourly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_monthly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on cron.monthly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_monthly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.monthly/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.monthly/" test_ref="oval:ssg-test_file_owner_cron_monthly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_cron_weekly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on cron.weekly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_cron_weekly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.weekly/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/cron.weekly/" test_ref="oval:ssg-test_file_owner_cron_weekly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_crontab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on crontab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_crontab" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/crontab is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/crontab" test_ref="oval:ssg-test_file_owner_crontab_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_efi_grub2_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_efi_grub2_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_efi_user_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/user.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_efi_user_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/user.cfg is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /boot/grub2/user.cfg" test_ref="oval:ssg-test_file_owner_efi_user_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_chrony_keys:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/chrony.keys File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_chrony_keys" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/chrony.keys is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/chrony.keys" test_ref="oval:ssg-test_file_owner_etc_chrony_keys_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_crypttab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/crypttab File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_crypttab" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/crypttab is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/crypttab" test_ref="oval:ssg-test_file_owner_etc_crypttab_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_group" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/group is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/group" test_ref="oval:ssg-test_file_owner_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_gshadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/gshadow is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/gshadow" test_ref="oval:ssg-test_file_owner_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_ipsec_conf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/ipsec.conf File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_ipsec_conf" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.conf is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/ipsec.conf" test_ref="oval:ssg-test_file_owner_etc_ipsec_conf_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_ipsec_secrets:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/ipsec.secrets File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_ipsec_secrets" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.secrets is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/ipsec.secrets" test_ref="oval:ssg-test_file_owner_etc_ipsec_secrets_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_issue_net:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify ownership of System Login Banner for Remote Connections</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_issue_net" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/issue.net is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/issue.net" test_ref="oval:ssg-test_file_owner_etc_issue_net_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_passwd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/passwd is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/passwd" test_ref="oval:ssg-test_file_owner_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_sestatus_conf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/sestatus.conf File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_sestatus_conf" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sestatus.conf is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/sestatus.conf" test_ref="oval:ssg-test_file_owner_etc_sestatus_conf_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_shadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shadow is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/shadow" test_ref="oval:ssg-test_file_owner_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_shells:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Who Owns /etc/shells File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_shells" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shells is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/shells" test_ref="oval:ssg-test_file_owner_etc_shells_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_etc_sudoers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /etc/sudoers File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_etc_sudoers" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sudoers is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/sudoers" test_ref="oval:ssg-test_file_owner_etc_sudoers_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_grub2_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_grub2_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_owner_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_sshd_config:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Owner on SSH Server config file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_sshd_config" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/sshd_config is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/ssh/sshd_config" test_ref="oval:ssg-test_file_owner_sshd_config_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_systemmap:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns System.map Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_systemmap" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /boot/" test_ref="oval:ssg-test_file_owner_systemmap_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_user_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/user.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_user_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/user.cfg is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /boot/grub2/user.cfg" test_ref="oval:ssg-test_file_owner_user_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_var_log:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_var_log" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /var/log/" test_ref="oval:ssg-test_file_owner_var_log_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_var_log_messages:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_var_log_messages" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/messages is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /var/log/messages" test_ref="oval:ssg-test_file_owner_var_log_messages_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_owner_var_log_syslog:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log/syslog File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_owner_var_log_syslog" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/syslog is owned by 104.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /var/log/syslog" test_ref="oval:ssg-test_file_owner_var_log_syslog_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_ownership_audit_configuration:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Audit Configuration Files Must Be Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_ownership_audit_configuration" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/audit/, /etc/audit/rules.d/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/audit/" test_ref="oval:ssg-test_file_ownership_audit_configuration_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_ownership_audit_configuration_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_ownership_library_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Files Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_ownership_library_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /lib/" test_ref="oval:ssg-test_file_ownership_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /lib64/" test_ref="oval:ssg-test_file_ownership_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib/" test_ref="oval:ssg-test_file_ownership_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file ownership of /usr/lib64/" test_ref="oval:ssg-test_file_ownership_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_ownership_sshd_private_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Ownership on SSH Server Private *_key Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_ownership_sshd_private_key" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/ssh/" test_ref="oval:ssg-test_file_ownership_sshd_private_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_ownership_sshd_pub_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Ownership on SSH Server Public *.pub Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_ownership_sshd_pub_key" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/ is owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file ownership of /etc/ssh/" test_ref="oval:ssg-test_file_ownership_sshd_pub_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_at_allow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/at.allow file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_at_allow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/at.allow has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/at.allow" test_ref="oval:ssg-test_file_permissions_at_allow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_audit_configuration:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Audit Configuration Files Permissions are 640 or More Restrictive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_audit_configuration" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/audit/, /etc/audit/rules.d/ has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/audit/" test_ref="oval:ssg-test_file_permissions_audit_configuration_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_permissions_audit_configuration_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_backup_etc_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_backup_etc_group" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/group- has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/group-" test_ref="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_backup_etc_gshadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/gshadow- has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/gshadow-" test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_backup_etc_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_backup_etc_passwd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/passwd- has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/passwd-" test_ref="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_backup_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_backup_etc_shadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shadow- has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/shadow-" test_ref="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_cron_allow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/cron.allow file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_cron_allow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.allow has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/cron.allow" test_ref="oval:ssg-test_file_permissions_cron_allow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_cron_d:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on cron.d</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_cron_d" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.d/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/cron.d/" test_ref="oval:ssg-test_file_permissions_cron_d_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_cron_daily:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on cron.daily</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_cron_daily" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.daily/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/cron.daily/" test_ref="oval:ssg-test_file_permissions_cron_daily_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_cron_hourly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on cron.hourly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_cron_hourly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.hourly/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/cron.hourly/" test_ref="oval:ssg-test_file_permissions_cron_hourly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_cron_monthly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on cron.monthly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_cron_monthly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.monthly/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/cron.monthly/" test_ref="oval:ssg-test_file_permissions_cron_monthly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_cron_weekly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on cron.weekly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_cron_weekly" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/cron.weekly/ has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/cron.weekly/" test_ref="oval:ssg-test_file_permissions_cron_weekly_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_crontab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on crontab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_crontab" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/crontab has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/crontab" test_ref="oval:ssg-test_file_permissions_crontab_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_efi_grub2_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_efi_user_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/user.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_efi_user_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/user.cfg has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /boot/grub2/user.cfg" test_ref="oval:ssg-test_file_permissions_efi_user_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_audit_auditd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_audit_auditd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/audit/auditd.conf has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/audit/auditd.conf" test_ref="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/audit/rules.d/*.rules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_audit_rulesd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/audit/rules.d/ has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_chrony_keys:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/chrony.keys File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_chrony_keys" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/chrony.keys has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/chrony.keys" test_ref="oval:ssg-test_file_permissions_etc_chrony_keys_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_crypttab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/crypttab File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_crypttab" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/crypttab has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/crypttab" test_ref="oval:ssg-test_file_permissions_etc_crypttab_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_group:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_group" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/group has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/group" test_ref="oval:ssg-test_file_permissions_etc_group_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_gshadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/gshadow has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/gshadow" test_ref="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_ipsec_conf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/ipsec.conf File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_ipsec_conf" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.conf has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/ipsec.conf" test_ref="oval:ssg-test_file_permissions_etc_ipsec_conf_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_ipsec_secrets:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/ipsec.secrets File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_ipsec_secrets" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ipsec.secrets has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/ipsec.secrets" test_ref="oval:ssg-test_file_permissions_etc_ipsec_secrets_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_issue_net:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify permissions on System Login Banner for Remote Connections</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_issue_net" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/issue.net has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/issue.net" test_ref="oval:ssg-test_file_permissions_etc_issue_net_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_passwd:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_passwd" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/passwd has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/passwd" test_ref="oval:ssg-test_file_permissions_etc_passwd_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_sestatus_conf:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/sestatus.conf File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_sestatus_conf" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sestatus.conf has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/sestatus.conf" test_ref="oval:ssg-test_file_permissions_etc_sestatus_conf_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_shadow:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_shadow" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shadow has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/shadow" test_ref="oval:ssg-test_file_permissions_etc_shadow_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_shells:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/shells File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_shells" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/shells has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/shells" test_ref="oval:ssg-test_file_permissions_etc_shells_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_etc_sudoers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions On /etc/sudoers File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_etc_sudoers" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/sudoers has mode 0440.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/sudoers" test_ref="oval:ssg-test_file_permissions_etc_sudoers_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_grub2_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_grub2_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_library_dirs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Files Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_library_dirs" source="ssg"/>
            <oval-def:description>This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ has mode 7755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /lib/" test_ref="oval:ssg-test_file_permissions_library_dirs_0:tst:1"/>
            <oval-def:criterion comment="Check file mode of /lib64/" test_ref="oval:ssg-test_file_permissions_library_dirs_1:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib/" test_ref="oval:ssg-test_file_permissions_library_dirs_2:tst:1"/>
            <oval-def:criterion comment="Check file mode of /usr/lib64/" test_ref="oval:ssg-test_file_permissions_library_dirs_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_sshd_config:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server config file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_sshd_config" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/sshd_config has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/ssh/sshd_config" test_ref="oval:ssg-test_file_permissions_sshd_config_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_sshd_pub_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server Public *.pub Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_sshd_pub_key" source="ssg"/>
            <oval-def:description>This test makes sure that /etc/ssh/ has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /etc/ssh/" test_ref="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_sudo:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure That the sudo Binary Has the Correct Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_sudo" source="ssg"/>
            <oval-def:description>This test makes sure that /usr/bin/sudo has mode 4110.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /usr/bin/sudo" test_ref="oval:ssg-test_file_permissions_sudo_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_systemmap:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on System.map Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_systemmap" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/ has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /boot/" test_ref="oval:ssg-test_file_permissions_systemmap_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_user_cfg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/user.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_user_cfg" source="ssg"/>
            <oval-def:description>This test makes sure that /boot/grub2/user.cfg has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /boot/grub2/user.cfg" test_ref="oval:ssg-test_file_permissions_user_cfg_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_var_log:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_var_log" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/ has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /var/log/" test_ref="oval:ssg-test_file_permissions_var_log_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_var_log_messages:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_var_log_messages" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/messages has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /var/log/messages" test_ref="oval:ssg-test_file_permissions_var_log_messages_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_var_log_syslog:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log/syslog File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_permissions_var_log_syslog" source="ssg"/>
            <oval-def:description>This test makes sure that /var/log/syslog has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file mode of /var/log/syslog" test_ref="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_sshd_50_redhat_exists:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="file_sshd_50_redhat_exists" source="ssg"/>
            <oval-def:description>This test makes sure that/etc/ssh/sshd_config.d/50-redhat.conf does exist.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Ensure that /etc/ssh/sshd_config.d/50-redhat.conf does exist." test_ref="oval:ssg-test_file_sshd_50_redhat_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-firewalld-backend:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Firewalld to Use the Nftables Backend</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="firewalld-backend" source="ssg"/>
            <oval-def:description>Ensure 'FirewallBackend' is configured with value 'nftables' in /etc/firewalld/firewalld.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the FirewallBackend in /etc/firewalld/firewalld.conf" test_ref="oval:ssg-test_firewalld-backend:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_audit_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_audit_argument" source="ssg"/>
            <oval-def:description>Ensure audit=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if audit=1 is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_audit_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_audit_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_audit_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Extend Audit Backlog Limit for the Audit Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_audit_backlog_limit_argument" source="ssg"/>
            <oval-def:description>Ensure audit_backlog_limit=8192 is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if audit_backlog_limit=8192 is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_audit_backlog_limit_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_enable_iommu_force:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>IOMMU configuration directive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_enable_iommu_force" source="ssg"/>
            <oval-def:description>Ensure iommu=force is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if iommu=force is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_iommu_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_iommu_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_iommu_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_init_on_alloc_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure kernel to zero out memory before allocation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_init_on_alloc_argument" source="ssg"/>
            <oval-def:description>Ensure init_on_alloc=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if init_on_alloc=1 is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_init_on_alloc_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for init_on_alloc=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_init_on_alloc_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for init_on_alloc=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_init_on_alloc_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_l1tf_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure L1 Terminal Fault mitigations</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_l1tf_argument" source="ssg"/>
            <oval-def:description>Ensure l1tf is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if l1tf is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_l1tf_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_l1tf_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_l1tf_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_mce_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Force kernel panic on uncorrected MCEs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_mce_argument" source="ssg"/>
            <oval-def:description>Ensure mce=0 is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if mce=0 is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_mce_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_mce_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_mce_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_mds_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Microarchitectural Data Sampling mitigation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_mds_argument" source="ssg"/>
            <oval-def:description>Ensure mds is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if mds is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_mds_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_mds_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_mds_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_nosmap_argument_absent:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SMAP is not disabled during boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_nosmap_argument_absent" source="ssg"/>
            <oval-def:description>Ensure nosmap is not set in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if nosmap is absent in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_nosmap_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion comment="check for absence of nosmap in /etc/default/grub on GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_nosmap_argument_absent:tst:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="check for absence ofnosmap in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1"/>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_nosmep_argument_absent:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure SMEP is not disabled during boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_nosmep_argument_absent" source="ssg"/>
            <oval-def:description>Ensure nosmep is not set in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if nosmep is absent in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_nosmep_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion comment="check for absence of nosmep in /etc/default/grub on GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_nosmep_argument_absent:tst:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="check for absence ofnosmep in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1"/>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_page_alloc_shuffle_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable randomization of the page allocator</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_page_alloc_shuffle_argument" source="ssg"/>
            <oval-def:description>Ensure page_alloc.shuffle=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if page_alloc.shuffle=1 is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_page_alloc_shuffle_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for page_alloc.shuffle=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_page_alloc_shuffle_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for page_alloc.shuffle=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_page_alloc_shuffle_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_page_poison_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable page allocator poisoning</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_page_poison_argument" source="ssg"/>
            <oval-def:description>Ensure page_poison=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if page_poison=1 is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_page_poison_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_page_poison_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_page_poison_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_pti_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Page-Table Isolation (KPTI)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_pti_argument" source="ssg"/>
            <oval-def:description>Ensure pti=on is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if pti=on is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_pti_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_pti_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_pti_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_rng_core_default_quality_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the confidence in TPM for entropy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_rng_core_default_quality_argument" source="ssg"/>
            <oval-def:description>Ensure rng_core.default_quality is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if rng_core.default_quality is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_rng_core_default_quality_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_slab_nomerge_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable merging of slabs with similar size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_slab_nomerge_argument" source="ssg"/>
            <oval-def:description>Ensure slab_nomerge=yes is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if slab_nomerge=yes is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_slab_nomerge_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_slab_nomerge_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_slub_debug_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable SLUB/SLAB allocator poisoning</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_slub_debug_argument" source="ssg"/>
            <oval-def:description>Ensure slub_debug is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if slub_debug is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_slub_debug_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_slub_debug_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_slub_debug_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_spec_store_bypass_disable_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Speculative Store Bypass Mitigation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_spec_store_bypass_disable_argument" source="ssg"/>
            <oval-def:description>Ensure spec_store_bypass_disable is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if spec_store_bypass_disable is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_spectre_v2_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enforce Spectre v2 mitigation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_spectre_v2_argument" source="ssg"/>
            <oval-def:description>Ensure spectre_v2=on is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if spectre_v2=on is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_spectre_v2_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_spectre_v2_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_systemd_debug-shell_argument_absent:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure debug-shell service is not enabled during boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_systemd_debug-shell_argument_absent" source="ssg"/>
            <oval-def:description>Ensure systemd.debug-shell is not set in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if systemd.debug-shell is absent in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_systemd_debug_shell_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion comment="check for absence of systemd.debug-shell in /etc/default/grub on GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_systemd_debug_shell_argument_absent:tst:1"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="check for absence ofsystemd.debug-shell in /etc/default/grub on GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_systemd_debug_shell_argument_absent_default:tst:1"/>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-grub2_vsyscall_argument:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscalls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="grub2_vsyscall_argument" source="ssg"/>
            <oval-def:description>Ensure vsyscall=none is configured in the kernel line in /etc/default/grub.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if vsyscall=none is present in the boot parameters in the /boot/loader/entries/*.conf" test_ref="oval:ssg-test_grub2_vsyscall_entries:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criteria operator="OR">
                  <oval-def:criterion comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_vsyscall_argument:tst:1"/>
                </oval-def:criteria>
                <oval-def:criteria operator="AND">
                  <oval-def:criteria operator="OR">
                    <oval-def:criterion comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_vsyscall_argument_default:tst:1"/>
                  </oval-def:criteria>
                  <oval-def:extend_definition comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-install_smartcard_packages:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install Smart Card Packages For Multifactor Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="install_smartcard_packages" source="ssg"/>
            <oval-def:description>The RPM package openssl-pkcs11 should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package openssl-pkcs11 is installed" test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_acpi_custom_method:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Do not allow ACPI methods to be inserted/replaced at run time</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_acpi_custom_method" source="ssg"/>
            <oval-def:description>The kernel CONFIG_ACPI_CUSTOM_METHOD should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_acpi_custom_method:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_arm64_sw_ttbr0_pan:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Emulate Privileged Access Never (PAN)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_arm64_sw_ttbr0_pan" source="ssg"/>
            <oval-def:description>The kernel CONFIG_ARM64_SW_TTBR0_PAN should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_binfmt_misc:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable kernel support for MISC binaries</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_binfmt_misc" source="ssg"/>
            <oval-def:description>The kernel CONFIG_BINFMT_MISC should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_binfmt_misc:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_bug:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable support for BUG()</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_bug" source="ssg"/>
            <oval-def:description>The kernel CONFIG_BUG should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_bug:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_bug_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_bug_on_data_corruption:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Trigger a kernel BUG when data corruption is detected</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_bug_on_data_corruption" source="ssg"/>
            <oval-def:description>The kernel CONFIG_BUG_ON_DATA_CORRUPTION should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_compat_brk:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable compatibility with brk()</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_compat_brk" source="ssg"/>
            <oval-def:description>The kernel CONFIG_COMPAT_BRK should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_brk:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_brk_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_compat_vdso:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the 32-bit vDSO</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_compat_vdso" source="ssg"/>
            <oval-def:description>The kernel CONFIG_COMPAT_VDSO should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_vdso:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_debug_credentials:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable checks on credential management</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_debug_credentials" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEBUG_CREDENTIALS should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_credentials:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_debug_fs:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable kernel debugfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_debug_fs" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEBUG_FS should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_fs:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_fs_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_debug_list:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable checks on linked list manipulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_debug_list" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEBUG_LIST should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_list:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_debug_notifiers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable checks on notifier call chains</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_debug_notifiers" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEBUG_NOTIFIERS should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_notifiers:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_debug_sg:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable checks on scatter-gather (SG) table operations</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_debug_sg" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEBUG_SG should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_sg:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_debug_wx:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Warn on W+X mappings found at boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_debug_wx" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEBUG_WX should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_debug_wx:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_devkmem:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable /dev/kmem virtual device support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_devkmem" source="ssg"/>
            <oval-def:description>The kernel CONFIG_DEVKMEM should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_devkmem:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_devkmem_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_fortify_source:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden common str/mem functions against buffer overflows</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_fortify_source" source="ssg"/>
            <oval-def:description>The kernel CONFIG_FORTIFY_SOURCE should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_fortify_source:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_gcc_plugin_latent_entropy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Generate some entropy during boot and runtime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_latent_entropy" source="ssg"/>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_LATENT_ENTROPY should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_gcc_plugin_randstruct:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Randomize layout of sensitive kernel structures</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_randstruct" source="ssg"/>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_RANDSTRUCT should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_gcc_plugin_stackleak:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Poison kernel stack before returning from syscalls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_stackleak" source="ssg"/>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_STACKLEAK should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_gcc_plugin_structleak:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Force initialization of variables containing userspace addresses</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_structleak" source="ssg"/>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_STRUCTLEAK should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_gcc_plugin_structleak_byref_all:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>zero-init everything passed by reference</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_gcc_plugin_structleak_byref_all" source="ssg"/>
            <oval-def:description>The kernel CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_hardened_usercopy:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden memory copies between kernel and userspace</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_hardened_usercopy" source="ssg"/>
            <oval-def:description>The kernel CONFIG_HARDENED_USERCOPY should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hardened_usercopy:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_hardened_usercopy_fallback:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Do not allow usercopy whitelist violations to fallback to object size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_hardened_usercopy_fallback" source="ssg"/>
            <oval-def:description>The kernel CONFIG_HARDENED_USERCOPY_FALLBACK should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_hibernation:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable hibernation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_hibernation" source="ssg"/>
            <oval-def:description>The kernel CONFIG_HIBERNATION should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hibernation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_hibernation_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_ia32_emulation:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IA32 emulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_ia32_emulation" source="ssg"/>
            <oval-def:description>The kernel CONFIG_IA32_EMULATION should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ia32_emulation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_ipv6:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the IPv6 protocol</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_ipv6" source="ssg"/>
            <oval-def:description>The kernel CONFIG_IPV6 should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ipv6:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_ipv6_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_kexec:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable kexec system call</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_kexec" source="ssg"/>
            <oval-def:description>The kernel CONFIG_KEXEC should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_kexec:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_kexec_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_legacy_ptys:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable legacy (BSD) PTY support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_legacy_ptys" source="ssg"/>
            <oval-def:description>The kernel CONFIG_LEGACY_PTYS should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_ptys:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_legacy_vsyscall_emulate:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscall emulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_legacy_vsyscall_emulate" source="ssg"/>
            <oval-def:description>The kernel CONFIG_LEGACY_VSYSCALL_EMULATE should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_legacy_vsyscall_none:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscall mapping</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_legacy_vsyscall_none" source="ssg"/>
            <oval-def:description>The kernel CONFIG_LEGACY_VSYSCALL_NONE should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_legacy_vsyscall_xonly:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscall emulate execution only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_legacy_vsyscall_xonly" source="ssg"/>
            <oval-def:description>The kernel CONFIG_LEGACY_VSYSCALL_XONLY should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_modify_ldt_syscall:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the LDT (local descriptor table)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_modify_ldt_syscall" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODIFY_LDT_SYSCALL should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_module_sig:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable module signature verification</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_module_sig" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODULE_SIG should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_module_sig_all:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable automatic signing of all modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_module_sig_all" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_ALL should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_all:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_module_sig_force:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Require modules to be validly signed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_module_sig_force" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_FORCE should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_force:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_module_sig_hash:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Specify the hash to use when signing modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_module_sig_hash" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_HASH should have value according to var_kernel_config_module_sig_hash</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_hash:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_module_sig_key:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Specify module signing key to use</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_module_sig_key" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_KEY should have value according to var_kernel_config_module_sig_key</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_key:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_module_sig_sha512:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Sign kernel modules with SHA-512</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_module_sig_sha512" source="ssg"/>
            <oval-def:description>The kernel CONFIG_MODULE_SIG_SHA512 should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_module_sig_sha512:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_page_poisoning:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable poison of pages after freeing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_page_poisoning" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PAGE_POISONING should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_poisoning:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_page_poisoning_no_sanity:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable poison without sanity check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_page_poisoning_no_sanity" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PAGE_POISONING_NO_SANITY should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_page_poisoning_zero:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Use zero for poisoning instead of debugging value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_page_poisoning_zero" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PAGE_POISONING_ZERO should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_page_table_isolation:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove the kernel mapping in user mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_page_table_isolation" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PAGE_TABLE_ISOLATION should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_page_table_isolation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_panic_on_oops:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Kernel panic oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_panic_on_oops" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PANIC_ON_OOPS should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_panic_on_oops:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_panic_timeout:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Kernel panic timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_panic_timeout" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PANIC_TIMEOUT should have value according to var_kernel_config_panic_timeout</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_panic_timeout:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_proc_kcore:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable support for /proc/kkcore</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_proc_kcore" source="ssg"/>
            <oval-def:description>The kernel CONFIG_PROC_KCORE should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_proc_kcore:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_randomize_base:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Randomize the address of the kernel image (KASLR)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_randomize_base" source="ssg"/>
            <oval-def:description>The kernel CONFIG_RANDOMIZE_BASE should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_randomize_base:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_randomize_memory:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Randomize the kernel memory sections</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_randomize_memory" source="ssg"/>
            <oval-def:description>The kernel CONFIG_RANDOMIZE_MEMORY should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_randomize_memory:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_refcount_full:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Perform full reference count validation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_refcount_full" source="ssg"/>
            <oval-def:description>The kernel CONFIG_REFCOUNT_FULL should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_refcount_full:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_retpoline:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Avoid speculative indirect branches in kernel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_retpoline" source="ssg"/>
            <oval-def:description>The kernel CONFIG_RETPOLINE should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_retpoline:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_sched_stack_end_check:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Detect stack corruption on calls to schedule()</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_sched_stack_end_check" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SCHED_STACK_END_CHECK should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_seccomp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable seccomp to safely compute untrusted bytecode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_seccomp" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SECCOMP should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_seccomp:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_seccomp_filter:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable use of Berkeley Packet Filter with seccomp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_seccomp_filter" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SECCOMP_FILTER should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_seccomp_filter:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_security:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable different security models</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_security" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SECURITY should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_security_dmesg_restrict:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict unprivileged access to the kernel syslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_security_dmesg_restrict" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SECURITY_DMESG_RESTRICT should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_security_writable_hooks:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable mutable hooks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_security_writable_hooks" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SECURITY_WRITABLE_HOOKS should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_writable_hooks:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_writable_hooks_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_security_yama:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Yama support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_security_yama" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SECURITY_YAMA should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_security_yama:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_slab_freelist_hardened:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden slab freelist metadata</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_slab_freelist_hardened" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SLAB_FREELIST_HARDENED should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_slab_freelist_random:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Randomize slab freelist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_slab_freelist_random" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SLAB_FREELIST_RANDOM should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_freelist_random:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slab_freelist_random_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_slab_merge_default:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow merge of slab caches</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_slab_merge_default" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SLAB_MERGE_DEFAULT should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_merge_default:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_slub_debug:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable SLUB debugging support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_slub_debug" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SLUB_DEBUG should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_slub_debug:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_stackprotector:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Stack Protector buffer overlow detection</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_stackprotector" source="ssg"/>
            <oval-def:description>The kernel CONFIG_STACKPROTECTOR should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_stackprotector:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_stackprotector_strong:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Strong Stack Protector</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_stackprotector_strong" source="ssg"/>
            <oval-def:description>The kernel CONFIG_STACKPROTECTOR_STRONG should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_stackprotector_strong:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_strict_kernel_rwx:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Make the kernel text and rodata read-only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_strict_kernel_rwx" source="ssg"/>
            <oval-def:description>The kernel CONFIG_STRICT_KERNEL_RWX should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_strict_module_rwx:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Make the module text and rodata read-only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_strict_module_rwx" source="ssg"/>
            <oval-def:description>The kernel CONFIG_STRICT_MODULE_RWX should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_strict_module_rwx:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_syn_cookies:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable TCP/IP syncookie support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_syn_cookies" source="ssg"/>
            <oval-def:description>The kernel CONFIG_SYN_COOKIES should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_syn_cookies:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_unmap_kernel_at_el0:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Unmap kernel when running in userspace (aka KAISER)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_unmap_kernel_at_el0" source="ssg"/>
            <oval-def:description>The kernel CONFIG_UNMAP_KERNEL_AT_EL0 should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_vmap_stack:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>User a virtually-mapped stack</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_vmap_stack" source="ssg"/>
            <oval-def:description>The kernel CONFIG_VMAP_STACK should have value y</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_vmap_stack:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_config_x86_vsyscall_emulation:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable x86 vsyscall emulation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_config_x86_vsyscall_emulation" source="ssg"/>
            <oval-def:description>The kernel CONFIG_X86_VSYSCALL_EMULATION should have value n</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check presence of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1"/>
              <oval-def:criterion comment="Ensure all kernels have the config" test_ref="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check absense of build configuration of installed kernels" test_ref="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_atm_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable ATM Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_atm_disabled" source="ssg"/>
            <oval-def:description>The kernel module atm should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module atm blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_atm_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module atm disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Bluetooth Kernel Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_bluetooth_disabled" source="ssg"/>
            <oval-def:description>The kernel module bluetooth should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module bluetooth blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_bluetooth_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module bluetooth disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_can_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable CAN Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_can_disabled" source="ssg"/>
            <oval-def:description>The kernel module can should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module can blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_can_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module can disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_can_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of cramfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_cramfs_disabled" source="ssg"/>
            <oval-def:description>The kernel module cramfs should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module cramfs blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_cramfs_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module cramfs disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable DCCP Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_dccp_disabled" source="ssg"/>
            <oval-def:description>The kernel module dccp should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module dccp blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_dccp_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module dccp disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_firewire-core_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IEEE 1394 (FireWire) Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_firewire-core_disabled" source="ssg"/>
            <oval-def:description>The kernel module firewire-core should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module firewire-core blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_firewire-core_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module firewire-core disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_rds_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable RDS Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_rds_disabled" source="ssg"/>
            <oval-def:description>The kernel module rds should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module rds blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_rds_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module rds disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_sctp_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SCTP Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_sctp_disabled" source="ssg"/>
            <oval-def:description>The kernel module sctp should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module sctp blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_sctp_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module sctp disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_sctp_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of squashfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_squashfs_disabled" source="ssg"/>
            <oval-def:description>The kernel module squashfs should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module squashfs blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_squashfs_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module squashfs disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_tipc_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable TIPC Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_tipc_disabled" source="ssg"/>
            <oval-def:description>The kernel module tipc should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module tipc blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_tipc_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module tipc disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_udf_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of udf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_udf_disabled" source="ssg"/>
            <oval-def:description>The kernel module udf should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module udf blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_udf_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module udf disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Modprobe Loading of USB Storage Driver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_usb-storage_disabled" source="ssg"/>
            <oval-def:description>The kernel module usb-storage should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module usb-storage blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_usb-storage_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module usb-storage disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-kernel_module_uvcvideo_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the uvcvideo module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="kernel_module_uvcvideo_disabled" source="ssg"/>
            <oval-def:description>The kernel module uvcvideo should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel module uvcvideo blacklisted in modprobe.d" test_ref="oval:ssg-test_kernmod_uvcvideo_blacklisted:tst:1"/>
              <oval-def:criterion comment="kernel module uvcvideo disabled in modprobe.d" test_ref="oval:ssg-test_kernmod_uvcvideo_disabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_boot_efi_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /boot/efi</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_boot_efi_nosuid" source="ssg"/>
            <oval-def:description>/boot/efi should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /boot/efi" test_ref="oval:ssg-test_boot_efi_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot/efi does not exist" test_ref="oval:ssg-test_boot_efi_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /boot/efi in /etc/fstab" test_ref="oval:ssg-test_boot_efi_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot/efi does not exist in /etc/fstab" test_ref="oval:ssg-test_boot_efi_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_boot_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_boot_nodev" source="ssg"/>
            <oval-def:description>/boot should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /boot" test_ref="oval:ssg-test_boot_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot does not exist" test_ref="oval:ssg-test_boot_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /boot in /etc/fstab" test_ref="oval:ssg-test_boot_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot does not exist in /etc/fstab" test_ref="oval:ssg-test_boot_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_boot_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_boot_noexec" source="ssg"/>
            <oval-def:description>/boot should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /boot" test_ref="oval:ssg-test_boot_partition_noexec_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot does not exist" test_ref="oval:ssg-test_boot_partition_noexec_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /boot in /etc/fstab" test_ref="oval:ssg-test_boot_partition_noexec_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot does not exist in /etc/fstab" test_ref="oval:ssg-test_boot_partition_noexec_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_boot_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_boot_nosuid" source="ssg"/>
            <oval-def:description>/boot should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /boot" test_ref="oval:ssg-test_boot_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot does not exist" test_ref="oval:ssg-test_boot_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /boot in /etc/fstab" test_ref="oval:ssg-test_boot_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/boot does not exist in /etc/fstab" test_ref="oval:ssg-test_boot_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_dev_shm_nodev" source="ssg"/>
            <oval-def:description>/dev/shm should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_nodev_expected:tst:1"/>
              <oval-def:criterion negate="true" comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_partition_nodev_expected_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /dev/shm in /etc/fstab" test_ref="oval:ssg-test_dev_shm_partition_nodev_expected_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_dev_shm_noexec" source="ssg"/>
            <oval-def:description>/dev/shm should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_noexec_expected:tst:1"/>
              <oval-def:criterion negate="true" comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_partition_noexec_expected_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /dev/shm in /etc/fstab" test_ref="oval:ssg-test_dev_shm_partition_noexec_expected_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_dev_shm_nosuid" source="ssg"/>
            <oval-def:description>/dev/shm should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_nosuid_expected:tst:1"/>
              <oval-def:criterion negate="true" comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_partition_nosuid_expected_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /dev/shm in /etc/fstab" test_ref="oval:ssg-test_dev_shm_partition_nosuid_expected_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_home_grpquota:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add grpquota Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_home_grpquota" source="ssg"/>
            <oval-def:description>Home mount points should be mounted with mount option grpquota.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="All mount points which contain home directories are in expected location and grpquota is set" operator="AND">
            <oval-def:criterion comment="grpquota on Home mount points" test_ref="oval:ssg-test_home_partition_grpquota:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_home_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_home_nodev" source="ssg"/>
            <oval-def:description>/home should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /home" test_ref="oval:ssg-test_home_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/home does not exist" test_ref="oval:ssg-test_home_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /home in /etc/fstab" test_ref="oval:ssg-test_home_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/home does not exist in /etc/fstab" test_ref="oval:ssg-test_home_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_home_noexec:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_home_noexec" source="ssg"/>
            <oval-def:description>Home mount points should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="All mount points which contain home directories are in expected location and noexec is set" operator="AND">
            <oval-def:criterion comment="noexec on Home mount points" test_ref="oval:ssg-test_home_partition_noexec:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_home_nosuid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_home_nosuid" source="ssg"/>
            <oval-def:description>Home mount points should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="All mount points which contain home directories are in expected location and nosuid is set" operator="AND">
            <oval-def:criterion comment="nosuid on Home mount points" test_ref="oval:ssg-test_home_partition_nosuid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_home_usrquota:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add usrquota Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_home_usrquota" source="ssg"/>
            <oval-def:description>Home mount points should be mounted with mount option usrquota.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="All mount points which contain home directories are in expected location and usrquota is set" operator="AND">
            <oval-def:criterion comment="usrquota on Home mount points" test_ref="oval:ssg-test_home_partition_usrquota:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_krb_sec_remote_filesystems:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Mount Remote Filesystems with Kerberos Security</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_krb_sec_remote_filesystems" source="ssg"/>
            <oval-def:description>The sec_krb5_krb5i_krb5p option should be enabled for all NFS mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_sec_krb5_krb5i_krb5p_etc_fstab:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_nodev_remote_filesystems:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Mount Remote Filesystems with nodev</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_nodev_remote_filesystems" source="ssg"/>
            <oval-def:description>The nodev option should be enabled for all NFS mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_nodev_etc_fstab:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_nodev_removable_partitions" source="ssg"/>
            <oval-def:description>The nodev option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab" test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1"/>
                <oval-def:extend_definition comment="Check if CD/DVD drive is not configured to automount in /etc/fstab" definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion comment="Check if removable partition is using 'nodev' mount option in /etc/fstab" test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_noexec_remote_filesystems:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Mount Remote Filesystems with noexec</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_noexec_remote_filesystems" source="ssg"/>
            <oval-def:description>The noexec option should be enabled for all NFS mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_noexec_etc_fstab:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_noexec_removable_partitions" source="ssg"/>
            <oval-def:description>The noexec option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab" test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1"/>
                <oval-def:extend_definition comment="Check if CD/DVD drive is not configured to automount in /etc/fstab" definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion comment="Check if removable partition is using 'noexec' mount option in /etc/fstab" test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_nosuid_remote_filesystems:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Mount Remote Filesystems with nosuid</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_nosuid_remote_filesystems" source="ssg"/>
            <oval-def:description>The nosuid option should be enabled for all NFS mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_nosuid_etc_fstab:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="5" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_nosuid_removable_partitions" source="ssg"/>
            <oval-def:description>The nosuid option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab" test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1"/>
                <oval-def:extend_definition comment="Check if CD/DVD drive is not configured to automount in /etc/fstab" definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab" test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_opt_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /opt</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_opt_nosuid" source="ssg"/>
            <oval-def:description>/opt should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /opt" test_ref="oval:ssg-test_opt_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/opt does not exist" test_ref="oval:ssg-test_opt_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /opt in /etc/fstab" test_ref="oval:ssg-test_opt_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/opt does not exist in /etc/fstab" test_ref="oval:ssg-test_opt_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_srv_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /srv</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_srv_nosuid" source="ssg"/>
            <oval-def:description>/srv should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /srv" test_ref="oval:ssg-test_srv_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/srv does not exist" test_ref="oval:ssg-test_srv_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /srv in /etc/fstab" test_ref="oval:ssg-test_srv_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/srv does not exist in /etc/fstab" test_ref="oval:ssg-test_srv_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_tmp_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_tmp_nodev" source="ssg"/>
            <oval-def:description>/tmp should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /tmp" test_ref="oval:ssg-test_tmp_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/tmp does not exist" test_ref="oval:ssg-test_tmp_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /tmp in /etc/fstab" test_ref="oval:ssg-test_tmp_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/tmp does not exist in /etc/fstab" test_ref="oval:ssg-test_tmp_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_tmp_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_tmp_noexec" source="ssg"/>
            <oval-def:description>/tmp should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /tmp" test_ref="oval:ssg-test_tmp_partition_noexec_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/tmp does not exist" test_ref="oval:ssg-test_tmp_partition_noexec_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /tmp in /etc/fstab" test_ref="oval:ssg-test_tmp_partition_noexec_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/tmp does not exist in /etc/fstab" test_ref="oval:ssg-test_tmp_partition_noexec_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_tmp_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_tmp_nosuid" source="ssg"/>
            <oval-def:description>/tmp should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /tmp" test_ref="oval:ssg-test_tmp_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/tmp does not exist" test_ref="oval:ssg-test_tmp_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /tmp in /etc/fstab" test_ref="oval:ssg-test_tmp_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/tmp does not exist in /etc/fstab" test_ref="oval:ssg-test_tmp_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_log_audit_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_log_audit_nodev" source="ssg"/>
            <oval-def:description>/var/log/audit should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log/audit does not exist" test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var/log/audit in /etc/fstab" test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log/audit does not exist in /etc/fstab" test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_log_audit_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_log_audit_noexec" source="ssg"/>
            <oval-def:description>/var/log/audit should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log/audit does not exist" test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var/log/audit in /etc/fstab" test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log/audit does not exist in /etc/fstab" test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_log_audit_nosuid" source="ssg"/>
            <oval-def:description>/var/log/audit should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log/audit does not exist" test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var/log/audit in /etc/fstab" test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log/audit does not exist in /etc/fstab" test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_log_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_log_nodev" source="ssg"/>
            <oval-def:description>/var/log should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var/log" test_ref="oval:ssg-test_var_log_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log does not exist" test_ref="oval:ssg-test_var_log_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var/log in /etc/fstab" test_ref="oval:ssg-test_var_log_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log does not exist in /etc/fstab" test_ref="oval:ssg-test_var_log_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_log_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_log_noexec" source="ssg"/>
            <oval-def:description>/var/log should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var/log" test_ref="oval:ssg-test_var_log_partition_noexec_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log does not exist" test_ref="oval:ssg-test_var_log_partition_noexec_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var/log in /etc/fstab" test_ref="oval:ssg-test_var_log_partition_noexec_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log does not exist in /etc/fstab" test_ref="oval:ssg-test_var_log_partition_noexec_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_log_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_log_nosuid" source="ssg"/>
            <oval-def:description>/var/log should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var/log" test_ref="oval:ssg-test_var_log_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log does not exist" test_ref="oval:ssg-test_var_log_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var/log in /etc/fstab" test_ref="oval:ssg-test_var_log_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/log does not exist in /etc/fstab" test_ref="oval:ssg-test_var_log_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_nodev" source="ssg"/>
            <oval-def:description>/var should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var" test_ref="oval:ssg-test_var_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var does not exist" test_ref="oval:ssg-test_var_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var in /etc/fstab" test_ref="oval:ssg-test_var_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var does not exist in /etc/fstab" test_ref="oval:ssg-test_var_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_noexec" source="ssg"/>
            <oval-def:description>/var should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var" test_ref="oval:ssg-test_var_partition_noexec_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var does not exist" test_ref="oval:ssg-test_var_partition_noexec_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var in /etc/fstab" test_ref="oval:ssg-test_var_partition_noexec_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var does not exist in /etc/fstab" test_ref="oval:ssg-test_var_partition_noexec_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_nosuid" source="ssg"/>
            <oval-def:description>/var should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var" test_ref="oval:ssg-test_var_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var does not exist" test_ref="oval:ssg-test_var_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var in /etc/fstab" test_ref="oval:ssg-test_var_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var does not exist in /etc/fstab" test_ref="oval:ssg-test_var_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_tmp_nodev:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_tmp_nodev" source="ssg"/>
            <oval-def:description>/var/tmp should be mounted with mount option nodev.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var/tmp" test_ref="oval:ssg-test_var_tmp_partition_nodev_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/tmp does not exist" test_ref="oval:ssg-test_var_tmp_partition_nodev_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nodev on /var/tmp in /etc/fstab" test_ref="oval:ssg-test_var_tmp_partition_nodev_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/tmp does not exist in /etc/fstab" test_ref="oval:ssg-test_var_tmp_partition_nodev_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_tmp_noexec:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_tmp_noexec" source="ssg"/>
            <oval-def:description>/var/tmp should be mounted with mount option noexec.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var/tmp" test_ref="oval:ssg-test_var_tmp_partition_noexec_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/tmp does not exist" test_ref="oval:ssg-test_var_tmp_partition_noexec_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="noexec on /var/tmp in /etc/fstab" test_ref="oval:ssg-test_var_tmp_partition_noexec_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/tmp does not exist in /etc/fstab" test_ref="oval:ssg-test_var_tmp_partition_noexec_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-mount_option_var_tmp_nosuid:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="mount_option_var_tmp_nosuid" source="ssg"/>
            <oval-def:description>/var/tmp should be mounted with mount option nosuid.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var/tmp" test_ref="oval:ssg-test_var_tmp_partition_nosuid_optional:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/tmp does not exist" test_ref="oval:ssg-test_var_tmp_partition_nosuid_optional_exist:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="nosuid on /var/tmp in /etc/fstab" test_ref="oval:ssg-test_var_tmp_partition_nosuid_optional_in_fstab:tst:1"/>
              <oval-def:criterion negate="true" comment="/var/tmp does not exist in /etc/fstab" test_ref="oval:ssg-test_var_tmp_partition_nosuid_optional_exist_in_fstab:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_aide_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install AIDE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_aide_installed" source="ssg"/>
            <oval-def:description>The RPM package aide should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package aide is installed" test_ref="oval:ssg-test_package_aide_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_audispd-plugins_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install audispd-plugins Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_audispd-plugins_installed" source="ssg"/>
            <oval-def:description>The RPM package audispd-plugins should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package audispd-plugins is installed" test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_audit_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure the audit Subsystem is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_audit_installed" source="ssg"/>
            <oval-def:description>The RPM package audit should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package audit is installed" test_ref="oval:ssg-test_package_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_bind_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall bind Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_bind_removed" source="ssg"/>
            <oval-def:description>The RPM package bind should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package bind is removed" test_ref="oval:ssg-test_package_bind_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_chrony_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The Chrony package is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_chrony_installed" source="ssg"/>
            <oval-def:description>The RPM package chrony should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package chrony is installed" test_ref="oval:ssg-test_package_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_cron_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install the cron service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_cron_installed" source="ssg"/>
            <oval-def:description>The RPM package cronie should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package cronie is installed" test_ref="oval:ssg-test_package_cronie_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_crypto-policies_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install crypto-policies package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_crypto-policies_installed" source="ssg"/>
            <oval-def:description>The RPM package crypto-policies should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package crypto-policies is installed" test_ref="oval:ssg-test_package_crypto-policies_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_cryptsetup-luks_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install cryptsetup Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_cryptsetup-luks_installed" source="ssg"/>
            <oval-def:description>The RPM package cryptsetup should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package cryptsetup is installed" test_ref="oval:ssg-test_package_cryptsetup_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_cyrus-imapd_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall cyrus-imapd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_cyrus-imapd_removed" source="ssg"/>
            <oval-def:description>The RPM package cyrus-imapd should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package cyrus-imapd is removed" test_ref="oval:ssg-test_package_cyrus-imapd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_dconf_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>package_dconf_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_dconf_installed" source="ssg"/>
            <oval-def:description>The RPM package dconf should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package dconf is installed" test_ref="oval:ssg-test_package_dconf_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_dhcp_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall DHCP Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_dhcp_removed" source="ssg"/>
            <oval-def:description>The RPM package dhcp should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package dhcp is removed" test_ref="oval:ssg-test_package_dhcp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_dnf-automatic_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install dnf-automatic Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_dnf-automatic_installed" source="ssg"/>
            <oval-def:description>The RPM package dnf-automatic should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package dnf-automatic is installed" test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_dovecot_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall dovecot Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_dovecot_removed" source="ssg"/>
            <oval-def:description>The RPM package dovecot should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package dovecot is removed" test_ref="oval:ssg-test_package_dovecot_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_fapolicyd_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install fapolicyd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_fapolicyd_installed" source="ssg"/>
            <oval-def:description>The RPM package fapolicyd should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package fapolicyd is installed" test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_firewalld_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install firewalld Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_firewalld_installed" source="ssg"/>
            <oval-def:description>The RPM package firewalld should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package firewalld is installed" test_ref="oval:ssg-test_package_firewalld_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_ftp_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove ftp Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_ftp_removed" source="ssg"/>
            <oval-def:description>The RPM package ftp should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package ftp is removed" test_ref="oval:ssg-test_package_ftp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_gdm_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>package_gdm_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_gdm_installed" source="ssg"/>
            <oval-def:description>The RPM package gdm should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package gdm is installed" test_ref="oval:ssg-test_package_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_gnutls-utils_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure gnutls-utils is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_gnutls-utils_installed" source="ssg"/>
            <oval-def:description>The RPM package gnutls-utils should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package gnutls-utils is installed" test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_gssproxy_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall gssproxy Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_gssproxy_removed" source="ssg"/>
            <oval-def:description>The RPM package gssproxy should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package gssproxy is removed" test_ref="oval:ssg-test_package_gssproxy_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall the inet-based telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_inetutils-telnetd_removed" source="ssg"/>
            <oval-def:description>The RPM package inetutils-telnetd should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_iprutils_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall iprutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_iprutils_removed" source="ssg"/>
            <oval-def:description>The RPM package iprutils should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package iprutils is removed" test_ref="oval:ssg-test_package_iprutils_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_libreswan_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install libreswan Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_libreswan_installed" source="ssg"/>
            <oval-def:description>The RPM package libreswan should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package libreswan is installed" test_ref="oval:ssg-test_package_libreswan_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_libselinux_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install libselinux Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_libselinux_installed" source="ssg"/>
            <oval-def:description>The RPM package libselinux should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package libselinux is installed" test_ref="oval:ssg-test_package_libselinux_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_logrotate_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure logrotate is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_logrotate_installed" source="ssg"/>
            <oval-def:description>The RPM package logrotate should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package logrotate is installed" test_ref="oval:ssg-test_package_logrotate_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_mcafeetp_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install McAfee Endpoint Security for Linux (ENSL)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_mcafeetp_installed" source="ssg"/>
            <oval-def:description>The RPM package McAfeeTP should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package McAfeeTP is installed" test_ref="oval:ssg-test_package_McAfeeTP_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_net-snmp_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall net-snmp Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_net-snmp_removed" source="ssg"/>
            <oval-def:description>The RPM package net-snmp should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_nfs-utils_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall nfs-utils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_nfs-utils_removed" source="ssg"/>
            <oval-def:description>The RPM package nfs-utils should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package nfs-utils is removed" test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_nftables_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install nftables Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_nftables_installed" source="ssg"/>
            <oval-def:description>The RPM package nftables should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package nftables is installed" test_ref="oval:ssg-test_package_nftables_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_nis_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall the nis package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_nis_removed" source="ssg"/>
            <oval-def:description>The RPM package nis should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_nss-tools_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure nss-tools is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_nss-tools_installed" source="ssg"/>
            <oval-def:description>The RPM package nss-tools should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package nss-tools is installed" test_ref="oval:ssg-test_package_nss-tools_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_opensc_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install the opensc Package For Multifactor Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_opensc_installed" source="ssg"/>
            <oval-def:description>The RPM package opensc should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package opensc is installed" test_ref="oval:ssg-test_package_opensc_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_openscap-scanner_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install openscap-scanner Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_openscap-scanner_installed" source="ssg"/>
            <oval-def:description>The RPM package openscap-scanner should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package openscap-scanner is installed" test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_openssh-clients_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install OpenSSH client software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_openssh-clients_installed" source="ssg"/>
            <oval-def:description>The RPM package openssh-clients should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package openssh-clients is installed" test_ref="oval:ssg-test_package_openssh-clients_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_openssh-server_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install the OpenSSH Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_openssh-server_installed" source="ssg"/>
            <oval-def:description>The RPM package openssh-server should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package openssh-server is installed" test_ref="oval:ssg-test_package_openssh-server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_openssh-server_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove the OpenSSH Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_openssh-server_removed" source="ssg"/>
            <oval-def:description>The RPM package openssh-server should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_pcsc-lite_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install the pcsc-lite package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_pcsc-lite_installed" source="ssg"/>
            <oval-def:description>The RPM package pcsc-lite should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package pcsc-lite is installed" test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_policycoreutils-python-utils_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install policycoreutils-python-utils package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_policycoreutils-python-utils_installed" source="ssg"/>
            <oval-def:description>The RPM package policycoreutils-python-utils should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package policycoreutils-python-utils is installed" test_ref="oval:ssg-test_package_policycoreutils-python-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_policycoreutils_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install policycoreutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_policycoreutils_installed" source="ssg"/>
            <oval-def:description>The RPM package policycoreutils should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package policycoreutils is installed" test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_postfix_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The Postfix package is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_postfix_installed" source="ssg"/>
            <oval-def:description>The RPM package postfix should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package postfix is installed" test_ref="oval:ssg-test_package_postfix_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_quagga_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall quagga Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_quagga_removed" source="ssg"/>
            <oval-def:description>The RPM package quagga should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package quagga is removed" test_ref="oval:ssg-test_package_quagga_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rear_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install rear Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_rear_installed" source="ssg"/>
            <oval-def:description>The RPM package rear should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package rear is installed" test_ref="oval:ssg-test_package_rear_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rng-tools_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install rng-tools Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_rng-tools_installed" source="ssg"/>
            <oval-def:description>The RPM package rng-tools should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package rng-tools is installed" test_ref="oval:ssg-test_package_rng-tools_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rsh-server_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall rsh-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_rsh-server_removed" source="ssg"/>
            <oval-def:description>The RPM package rsh-server should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package rsh-server is removed" test_ref="oval:ssg-test_package_rsh-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rsh_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall rsh Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_rsh_removed" source="ssg"/>
            <oval-def:description>The RPM package rsh should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package rsh is removed" test_ref="oval:ssg-test_package_rsh_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rsyslog-gnutls_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog-gnutls is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_rsyslog-gnutls_installed" source="ssg"/>
            <oval-def:description>The RPM package rsyslog-gnutls should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package rsyslog-gnutls is installed" test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rsyslog_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_rsyslog_installed" source="ssg"/>
            <oval-def:description>The RPM package rsyslog should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_s-nail_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The s-nail Package Is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_s-nail_installed" source="ssg"/>
            <oval-def:description>The RPM package s-nail should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package s-nail is installed" test_ref="oval:ssg-test_package_s-nail_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_scap-security-guide_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install scap-security-guide Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_scap-security-guide_installed" source="ssg"/>
            <oval-def:description>The RPM package scap-security-guide should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package scap-security-guide is installed" test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_sendmail_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall Sendmail Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_sendmail_removed" source="ssg"/>
            <oval-def:description>The RPM package sendmail should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package sendmail is removed" test_ref="oval:ssg-test_package_sendmail_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot-plugins Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_setroubleshoot-plugins_removed" source="ssg"/>
            <oval-def:description>The RPM package setroubleshoot-plugins should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package setroubleshoot-plugins is removed" test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_setroubleshoot-server_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_setroubleshoot-server_removed" source="ssg"/>
            <oval-def:description>The RPM package setroubleshoot-server should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package setroubleshoot-server is removed" test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_setroubleshoot_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_setroubleshoot_removed" source="ssg"/>
            <oval-def:description>The RPM package setroubleshoot should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package setroubleshoot is removed" test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_squid_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall squid Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_squid_removed" source="ssg"/>
            <oval-def:description>The RPM package squid should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package squid is removed" test_ref="oval:ssg-test_package_squid_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_sssd_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install the SSSD Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_sssd_installed" source="ssg"/>
            <oval-def:description>The RPM package sssd should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package sssd is installed" test_ref="oval:ssg-test_package_sssd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_sudo_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install sudo Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_sudo_installed" source="ssg"/>
            <oval-def:description>The RPM package sudo should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package sudo is installed" test_ref="oval:ssg-test_package_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_syslogng_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure syslog-ng is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_syslogng_installed" source="ssg"/>
            <oval-def:description>The RPM package syslog-ng should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package syslog-ng is installed" test_ref="oval:ssg-test_package_syslog-ng_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_talk-server_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall talk-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_talk-server_removed" source="ssg"/>
            <oval-def:description>The RPM package talk-server should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package talk-server is removed" test_ref="oval:ssg-test_package_talk-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_talk_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall talk Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_talk_removed" source="ssg"/>
            <oval-def:description>The RPM package talk should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package talk is removed" test_ref="oval:ssg-test_package_talk_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_telnet-server_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall telnet-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_telnet-server_removed" source="ssg"/>
            <oval-def:description>The RPM package telnet-server should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package telnet-server is removed" test_ref="oval:ssg-test_package_telnet-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_telnet_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove telnet Clients</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_telnet_removed" source="ssg"/>
            <oval-def:description>The RPM package telnet should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package telnet is removed" test_ref="oval:ssg-test_package_telnet_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall the ssl compliant telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_telnetd-ssl_removed" source="ssg"/>
            <oval-def:description>The RPM package telnetd-ssl should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_telnetd_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall the telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_telnetd_removed" source="ssg"/>
            <oval-def:description>The RPM package telnetd should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_tftp-server_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall tftp-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_tftp-server_removed" source="ssg"/>
            <oval-def:description>The RPM package tftp-server should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package tftp-server is removed" test_ref="oval:ssg-test_package_tftp-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_tftp_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove tftp Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_tftp_removed" source="ssg"/>
            <oval-def:description>The RPM package tftp should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package tftp is removed" test_ref="oval:ssg-test_package_tftp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_tuned_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall tuned Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_tuned_removed" source="ssg"/>
            <oval-def:description>The RPM package tuned should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package tuned is removed" test_ref="oval:ssg-test_package_tuned_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_usbguard_installed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Install usbguard Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_usbguard_installed" source="ssg"/>
            <oval-def:description>The RPM package usbguard should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package usbguard is installed" test_ref="oval:ssg-test_package_usbguard_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_vsftpd_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Uninstall vsftpd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_vsftpd_removed" source="ssg"/>
            <oval-def:description>The RPM package vsftpd should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package vsftpd is removed" test_ref="oval:ssg-test_package_vsftpd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Remove the X Windows Package Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="package_xorg-x11-server-common_removed" source="ssg"/>
            <oval-def:description>The RPM package xorg-x11-server-common should be removed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="package xorg-x11-server-common is removed" test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_dev_shm:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /dev/shm is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_dev_shm" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /dev/shm. If /dev/shm will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/dev/shm on own partition" test_ref="oval:ssg-testdev_shm_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_home:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /home Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_home" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /home. If /home will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/home on own partition" test_ref="oval:ssg-testhome_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_srv:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /srv Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_srv" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /srv. If /srv will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/srv on own partition" test_ref="oval:ssg-testsrv_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_tmp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /tmp Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_tmp" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /tmp. If /tmp will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/tmp on own partition" test_ref="oval:ssg-testtmp_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_var:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /var Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_var" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /var. If /var will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/var on own partition" test_ref="oval:ssg-testvar_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_var_log:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/log Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_var_log" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /var/log. If /var/log will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/var/log on own partition" test_ref="oval:ssg-testvar_log_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_var_log_audit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/log/audit Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_var_log_audit" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /var/log/audit. If /var/log/audit will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/var/log/audit on own partition" test_ref="oval:ssg-testvar_log_audit_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-partition_for_var_tmp:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/tmp Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="partition_for_var_tmp" source="ssg"/>
            <oval-def:description>If stored locally, create a separate partition for
      /var/tmp. If /var/tmp will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="/var/tmp on own partition" test_ref="oval:ssg-testvar_tmp_partition:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-root_permissions_syslibrary_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="root_permissions_syslibrary_files" source="ssg"/>
            <oval-def:description>This test makes sure that /lib/, /lib64/, /usr/lib/, /usr/lib64/ is group owned by 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check file group ownership of /lib/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /lib64/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1"/>
            <oval-def:criterion comment="Check file group ownership of /usr/lib64/" test_ref="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_files_groupownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Log Files Are Owned By Appropriate Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_files_groupownership" source="ssg"/>
            <oval-def:description>All syslog log files should have appropriate ownership.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all system log files have appropriate groupowner set" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_files_ownership:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Log Files Are Owned By Appropriate User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_files_ownership" source="ssg"/>
            <oval-def:description>All syslog log files should have appropriate ownership.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all system log files have appropriate owner set" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-rsyslog_files_permissions:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure System Log Files Have Correct Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="rsyslog_files_permissions" source="ssg"/>
            <oval-def:description>All syslog log files should have appropriate ownership.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all system log files have appropriate permissions set" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_auditadm_exec_content:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the auditadm_exec_content SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_auditadm_exec_content" source="ssg"/>
            <oval-def:description>The SELinux 'auditadm_exec_content' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="auditadm_exec_content is configured correctly" test_ref="oval:ssg-test_sebool_auditadm_exec_content:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_authlogin_nsswitch_use_ldap:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the authlogin_nsswitch_use_ldap SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_authlogin_nsswitch_use_ldap" source="ssg"/>
            <oval-def:description>The SELinux 'authlogin_nsswitch_use_ldap' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="authlogin_nsswitch_use_ldap is configured correctly" test_ref="oval:ssg-test_sebool_authlogin_nsswitch_use_ldap:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_authlogin_radius:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the authlogin_radius SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_authlogin_radius" source="ssg"/>
            <oval-def:description>The SELinux 'authlogin_radius' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="authlogin_radius is configured correctly" test_ref="oval:ssg-test_sebool_authlogin_radius:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_deny_execmem:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the deny_execmem SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_deny_execmem" source="ssg"/>
            <oval-def:description>The SELinux 'deny_execmem' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="deny_execmem is configured correctly" test_ref="oval:ssg-test_sebool_deny_execmem:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_kerberos_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the kerberos_enabled SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_kerberos_enabled" source="ssg"/>
            <oval-def:description>The SELinux 'kerberos_enabled' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kerberos_enabled is configured correctly" test_ref="oval:ssg-test_sebool_kerberos_enabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_polyinstantiation_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the polyinstantiation_enabled SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_polyinstantiation_enabled" source="ssg"/>
            <oval-def:description>The SELinux 'polyinstantiation_enabled' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="polyinstantiation_enabled is configured correctly" test_ref="oval:ssg-test_sebool_polyinstantiation_enabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_secure_mode_insmod:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure the secure_mode_insmod SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_secure_mode_insmod" source="ssg"/>
            <oval-def:description>The SELinux 'secure_mode_insmod' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="secure_mode_insmod is configured correctly" test_ref="oval:ssg-test_sebool_secure_mode_insmod:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_selinuxuser_execheap:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the selinuxuser_execheap SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_selinuxuser_execheap" source="ssg"/>
            <oval-def:description>The SELinux 'selinuxuser_execheap' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="selinuxuser_execheap is configured correctly" test_ref="oval:ssg-test_sebool_selinuxuser_execheap:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_selinuxuser_execmod:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the selinuxuser_execmod SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_selinuxuser_execmod" source="ssg"/>
            <oval-def:description>The SELinux 'selinuxuser_execmod' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="selinuxuser_execmod is configured correctly" test_ref="oval:ssg-test_sebool_selinuxuser_execmod:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_selinuxuser_execstack:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the selinuxuser_execstack SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_selinuxuser_execstack" source="ssg"/>
            <oval-def:description>The SELinux 'selinuxuser_execstack' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="selinuxuser_execstack is configured correctly" test_ref="oval:ssg-test_sebool_selinuxuser_execstack:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sebool_ssh_sysadm_login:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the ssh_sysadm_login SELinux Boolean</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sebool_ssh_sysadm_login" source="ssg"/>
            <oval-def:description>The SELinux 'ssh_sysadm_login' boolean should be set in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="ssh_sysadm_login is configured correctly" test_ref="oval:ssg-test_sebool_ssh_sysadm_login:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_atd_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable At Service (atd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_atd_disabled" source="ssg"/>
            <oval-def:description>The atd service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package at removed or service atd is not configured to start" operator="OR">
            <oval-def:criterion comment="at removed" test_ref="oval:ssg-service_atd_disabled_test_service_atd_package_at_removed:tst:1"/>
            <oval-def:criteria comment="service atd is not configured to start" operator="AND">
              <oval-def:criterion comment="atd is not running" test_ref="oval:ssg-test_service_not_running_service_atd_disabled_atd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service atd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_atd_disabled_atd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_auditd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable auditd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_auditd_enabled" source="ssg"/>
            <oval-def:description>The auditd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package audit installed and service auditd is configured to start" operator="AND">
            <oval-def:criterion comment="audit installed" test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1"/>
            <oval-def:criteria comment="service auditd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="auditd is running" test_ref="oval:ssg-test_service_running_auditd:tst:1"/>
              <oval-def:criteria comment="service auditd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants auditd socket" test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_autofs_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the Automounter</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_autofs_disabled" source="ssg"/>
            <oval-def:description>The autofs service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package autofs removed or service autofs is not configured to start" operator="OR">
            <oval-def:criterion comment="autofs removed" test_ref="oval:ssg-service_autofs_disabled_test_service_autofs_package_autofs_removed:tst:1"/>
            <oval-def:criteria comment="service autofs is not configured to start" operator="AND">
              <oval-def:criterion comment="autofs is not running" test_ref="oval:ssg-test_service_not_running_service_autofs_disabled_autofs:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service autofs is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_autofs_disabled_autofs:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_avahi-daemon_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Avahi Server Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_avahi-daemon_disabled" source="ssg"/>
            <oval-def:description>The avahi-daemon service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package avahi removed or service avahi-daemon is not configured to start" operator="OR">
            <oval-def:criterion comment="avahi removed" test_ref="oval:ssg-service_avahi-daemon_disabled_test_service_avahi-daemon_package_avahi_removed:tst:1"/>
            <oval-def:criteria comment="service avahi-daemon is not configured to start" operator="AND">
              <oval-def:criterion comment="avahi-daemon is not running" test_ref="oval:ssg-test_service_not_running_service_avahi-daemon_disabled_avahi-daemon:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service avahi-daemon is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_avahi-daemon_disabled_avahi-daemon:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_chronyd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>The Chronyd service is enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_chronyd_enabled" source="ssg"/>
            <oval-def:description>The chronyd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package chrony installed and service chronyd is configured to start" operator="AND">
            <oval-def:criterion comment="chrony installed" test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1"/>
            <oval-def:criteria comment="service chronyd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="chronyd is running" test_ref="oval:ssg-test_service_running_chronyd:tst:1"/>
              <oval-def:criteria comment="service chronyd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants chronyd" test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants chronyd socket" test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_crond_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable cron Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_crond_enabled" source="ssg"/>
            <oval-def:description>The crond service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package cronie installed and service crond is configured to start" operator="AND">
            <oval-def:criterion comment="cronie installed" test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1"/>
            <oval-def:criteria comment="service crond is configured to start and is running" operator="AND">
              <oval-def:criterion comment="crond is running" test_ref="oval:ssg-test_service_running_crond:tst:1"/>
              <oval-def:criteria comment="service crond is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants crond" test_ref="oval:ssg-test_multi_user_wants_crond:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants crond socket" test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_debug-shell_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable debug-shell SystemD Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_debug-shell_disabled" source="ssg"/>
            <oval-def:description>The debug-shell service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package systemd removed or service debug-shell is not configured to start" operator="OR">
            <oval-def:criterion comment="systemd removed" test_ref="oval:ssg-service_debug-shell_disabled_test_service_debug-shell_package_systemd_removed:tst:1"/>
            <oval-def:criteria comment="service debug-shell is not configured to start" operator="AND">
              <oval-def:criterion comment="debug-shell is not running" test_ref="oval:ssg-test_service_not_running_service_debug-shell_disabled_debug-shell:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service debug-shell is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_debug-shell_disabled_debug-shell:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_fapolicyd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the File Access Policy Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_fapolicyd_enabled" source="ssg"/>
            <oval-def:description>The fapolicyd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package fapolicyd installed and service fapolicyd is configured to start" operator="AND">
            <oval-def:criterion comment="fapolicyd installed" test_ref="oval:ssg-test_service_fapolicyd_package_fapolicyd_installed:tst:1"/>
            <oval-def:criteria comment="service fapolicyd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="fapolicyd is running" test_ref="oval:ssg-test_service_running_fapolicyd:tst:1"/>
              <oval-def:criteria comment="service fapolicyd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants fapolicyd" test_ref="oval:ssg-test_multi_user_wants_fapolicyd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants fapolicyd socket" test_ref="oval:ssg-test_multi_user_wants_fapolicyd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_firewalld_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify firewalld Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_firewalld_enabled" source="ssg"/>
            <oval-def:description>The firewalld service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package firewalld installed and service firewalld is configured to start" operator="AND">
            <oval-def:criterion comment="firewalld installed" test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1"/>
            <oval-def:criteria comment="service firewalld is configured to start and is running" operator="AND">
              <oval-def:criterion comment="firewalld is running" test_ref="oval:ssg-test_service_running_firewalld:tst:1"/>
              <oval-def:criteria comment="service firewalld is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants firewalld" test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants firewalld socket" test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_iptables_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify iptables Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_iptables_enabled" source="ssg"/>
            <oval-def:description>The iptables service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package iptables installed and service iptables is configured to start" operator="AND">
            <oval-def:criterion comment="iptables installed" test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1"/>
            <oval-def:criteria comment="service iptables is configured to start and is running" operator="AND">
              <oval-def:criterion comment="iptables is running" test_ref="oval:ssg-test_service_running_iptables:tst:1"/>
              <oval-def:criteria comment="service iptables is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants iptables" test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants iptables socket" test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_kdump_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable KDump Kernel Crash Analyzer (kdump)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_kdump_disabled" source="ssg"/>
            <oval-def:description>The kdump service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package kexec-tools removed or service kdump is not configured to start" operator="OR">
            <oval-def:criterion comment="kexec-tools removed" test_ref="oval:ssg-service_kdump_disabled_test_service_kdump_package_kexec-tools_removed:tst:1"/>
            <oval-def:criteria comment="service kdump is not configured to start" operator="AND">
              <oval-def:criterion comment="kdump is not running" test_ref="oval:ssg-test_service_not_running_service_kdump_disabled_kdump:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service kdump is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_kdump_disabled_kdump:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_nftables_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify nftables Service is Disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_nftables_disabled" source="ssg"/>
            <oval-def:description>The nftables service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package nftables removed or service nftables is not configured to start" operator="OR">
            <oval-def:criterion comment="nftables removed" test_ref="oval:ssg-service_nftables_disabled_test_service_nftables_package_nftables_removed:tst:1"/>
            <oval-def:criteria comment="service nftables is not configured to start" operator="AND">
              <oval-def:criterion comment="nftables is not running" test_ref="oval:ssg-test_service_not_running_service_nftables_disabled_nftables:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service nftables is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_nftables_disabled_nftables:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_oddjobd_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Odd Job Daemon (oddjobd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_oddjobd_disabled" source="ssg"/>
            <oval-def:description>The oddjobd service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package oddjob removed or service oddjobd is not configured to start" operator="OR">
            <oval-def:criterion comment="oddjob removed" test_ref="oval:ssg-service_oddjobd_disabled_test_service_oddjobd_package_oddjob_removed:tst:1"/>
            <oval-def:criteria comment="service oddjobd is not configured to start" operator="AND">
              <oval-def:criterion comment="oddjobd is not running" test_ref="oval:ssg-test_service_not_running_service_oddjobd_disabled_oddjobd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service oddjobd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_oddjobd_disabled_oddjobd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_pcscd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the pcscd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_pcscd_enabled" source="ssg"/>
            <oval-def:description>The pcscd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package pcsc-lite installed and service pcscd is configured to start" operator="AND">
            <oval-def:criterion comment="pcsc-lite installed" test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1"/>
            <oval-def:criteria comment="service pcscd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="pcscd is running" test_ref="oval:ssg-test_service_running_pcscd:tst:1"/>
              <oval-def:criteria comment="service pcscd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants pcscd" test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants pcscd socket" test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_postfix_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Postfix Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_postfix_enabled" source="ssg"/>
            <oval-def:description>The postfix service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package postfix installed and service postfix is configured to start" operator="AND">
            <oval-def:criterion comment="postfix installed" test_ref="oval:ssg-test_service_postfix_package_postfix_installed:tst:1"/>
            <oval-def:criteria comment="service postfix is configured to start and is running" operator="AND">
              <oval-def:criterion comment="postfix is running" test_ref="oval:ssg-test_service_running_postfix:tst:1"/>
              <oval-def:criteria comment="service postfix is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants postfix" test_ref="oval:ssg-test_multi_user_wants_postfix:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants postfix socket" test_ref="oval:ssg-test_multi_user_wants_postfix_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_rdisc_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Network Router Discovery Daemon (rdisc)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_rdisc_disabled" source="ssg"/>
            <oval-def:description>The rdisc service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package iputils removed or service rdisc is not configured to start" operator="OR">
            <oval-def:criterion comment="iputils removed" test_ref="oval:ssg-service_rdisc_disabled_test_service_rdisc_package_iputils_removed:tst:1"/>
            <oval-def:criteria comment="service rdisc is not configured to start" operator="AND">
              <oval-def:criterion comment="rdisc is not running" test_ref="oval:ssg-test_service_not_running_service_rdisc_disabled_rdisc:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rdisc is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_rdisc_disabled_rdisc:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_rlogin_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable rlogin Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_rlogin_disabled" source="ssg"/>
            <oval-def:description>The rlogin service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsh-server removed or service rlogin is not configured to start" operator="OR">
            <oval-def:criterion comment="rsh-server removed" test_ref="oval:ssg-service_rlogin_disabled_test_service_rlogin_package_rsh-server_removed:tst:1"/>
            <oval-def:criteria comment="service rlogin is not configured to start" operator="AND">
              <oval-def:criterion comment="rlogin is not running" test_ref="oval:ssg-test_service_not_running_service_rlogin_disabled_rlogin:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rlogin is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_rlogin_disabled_rlogin:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_rngd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the Hardware RNG Entropy Gatherer Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_rngd_enabled" source="ssg"/>
            <oval-def:description>The rngd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package rng-tools installed and service rngd is configured to start" operator="AND">
            <oval-def:criterion comment="rng-tools installed" test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1"/>
            <oval-def:criteria comment="service rngd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="rngd is running" test_ref="oval:ssg-test_service_running_rngd:tst:1"/>
              <oval-def:criteria comment="service rngd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants rngd" test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants rngd socket" test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_rsyncd_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyncd service is disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_rsyncd_disabled" source="ssg"/>
            <oval-def:description>The rsyncd service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsync-daemon removed or service rsyncd is not configured to start" operator="OR">
            <oval-def:criterion comment="rsync-daemon removed" test_ref="oval:ssg-service_rsyncd_disabled_test_service_rsyncd_package_rsync-daemon_removed:tst:1"/>
            <oval-def:criteria comment="service rsyncd is not configured to start" operator="AND">
              <oval-def:criterion comment="rsyncd is not running" test_ref="oval:ssg-test_service_not_running_service_rsyncd_disabled_rsyncd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rsyncd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_rsyncd_disabled_rsyncd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_rsyslog_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable rsyslog Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_rsyslog_enabled" source="ssg"/>
            <oval-def:description>The rsyslog service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
            <oval-def:criterion comment="rsyslog installed" test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1"/>
            <oval-def:criteria comment="service rsyslog is configured to start and is running" operator="AND">
              <oval-def:criterion comment="rsyslog is running" test_ref="oval:ssg-test_service_running_rsyslog:tst:1"/>
              <oval-def:criteria comment="service rsyslog is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants rsyslog socket" test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_snmpd_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable snmpd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_snmpd_disabled" source="ssg"/>
            <oval-def:description>The snmpd service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package net-snmp removed or service snmpd is not configured to start" operator="OR">
            <oval-def:criterion comment="net-snmp removed" test_ref="oval:ssg-service_snmpd_disabled_test_service_snmpd_package_net-snmp_removed:tst:1"/>
            <oval-def:criteria comment="service snmpd is not configured to start" operator="AND">
              <oval-def:criterion comment="snmpd is not running" test_ref="oval:ssg-test_service_not_running_service_snmpd_disabled_snmpd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service snmpd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_snmpd_disabled_snmpd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_squid_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Squid</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_squid_disabled" source="ssg"/>
            <oval-def:description>The squid service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package squid removed or service squid is not configured to start" operator="OR">
            <oval-def:criterion comment="squid removed" test_ref="oval:ssg-service_squid_disabled_test_service_squid_package_squid_removed:tst:1"/>
            <oval-def:criteria comment="service squid is not configured to start" operator="AND">
              <oval-def:criterion comment="squid is not running" test_ref="oval:ssg-test_service_not_running_service_squid_disabled_squid:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service squid is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_squid_disabled_squid:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_sshd_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Server If Possible</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_sshd_disabled" source="ssg"/>
            <oval-def:description>The sshd service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
            <oval-def:criterion comment="openssh-server removed" test_ref="oval:ssg-service_sshd_disabled_test_service_sshd_package_openssh-server_removed:tst:1"/>
            <oval-def:criteria comment="service sshd is not configured to start" operator="AND">
              <oval-def:criterion comment="sshd is not running" test_ref="oval:ssg-test_service_not_running_service_sshd_disabled_sshd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service sshd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_sshd_disabled_sshd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_sshd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the OpenSSH Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_sshd_enabled" source="ssg"/>
            <oval-def:description>The sshd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package openssh-server installed and service sshd is configured to start" operator="AND">
            <oval-def:criterion comment="openssh-server installed" test_ref="oval:ssg-test_service_sshd_package_openssh-server_installed:tst:1"/>
            <oval-def:criteria comment="service sshd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="sshd is running" test_ref="oval:ssg-test_service_running_sshd:tst:1"/>
              <oval-def:criteria comment="service sshd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants sshd" test_ref="oval:ssg-test_multi_user_wants_sshd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants sshd socket" test_ref="oval:ssg-test_multi_user_wants_sshd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_sssd_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the SSSD Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_sssd_enabled" source="ssg"/>
            <oval-def:description>The sssd service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package sssd-common installed and service sssd is configured to start" operator="AND">
            <oval-def:criterion comment="sssd-common installed" test_ref="oval:ssg-test_service_sssd_package_sssd-common_installed:tst:1"/>
            <oval-def:criteria comment="service sssd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="sssd is running" test_ref="oval:ssg-test_service_running_sssd:tst:1"/>
              <oval-def:criteria comment="service sssd is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants sssd" test_ref="oval:ssg-test_multi_user_wants_sssd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants sssd socket" test_ref="oval:ssg-test_multi_user_wants_sssd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_syslogng_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable syslog-ng Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_syslogng_enabled" source="ssg"/>
            <oval-def:description>The syslog-ng service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package syslog-ng installed and service syslog-ng is configured to start" operator="AND">
            <oval-def:criterion comment="syslog-ng installed" test_ref="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1"/>
            <oval-def:criteria comment="service syslog-ng is configured to start and is running" operator="AND">
              <oval-def:criterion comment="syslog-ng is running" test_ref="oval:ssg-test_service_running_syslog-ng:tst:1"/>
              <oval-def:criteria comment="service syslog-ng is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants syslog-ng" test_ref="oval:ssg-test_multi_user_wants_syslog-ng:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants syslog-ng socket" test_ref="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_systemd-coredump_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable acquiring, saving, and processing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_systemd-coredump_disabled" source="ssg"/>
            <oval-def:description>Disable systemd-coredump.socket</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Property LoadState of systemd-coredump.socket is masked" test_ref="oval:ssg-test_socket_loadstate_is_masked_systemd-coredump:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_systemd-journald_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable systemd-journald Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_systemd-journald_enabled" source="ssg"/>
            <oval-def:description>The systemd-journald service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package systemd installed and service systemd-journald is configured to start" operator="AND">
            <oval-def:criterion comment="systemd installed" test_ref="oval:ssg-test_service_systemd-journald_package_systemd_installed:tst:1"/>
            <oval-def:criteria comment="service systemd-journald is configured to start and is running" operator="AND">
              <oval-def:criterion comment="systemd-journald is running" test_ref="oval:ssg-test_service_running_systemd-journald:tst:1"/>
              <oval-def:criteria comment="service systemd-journald is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants systemd-journald" test_ref="oval:ssg-test_multi_user_wants_systemd-journald:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants systemd-journald socket" test_ref="oval:ssg-test_multi_user_wants_systemd-journald_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_telnet_disabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable telnet Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_telnet_disabled" source="ssg"/>
            <oval-def:description>The telnet service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package telnet-server removed or service telnet is not configured to start" operator="OR">
            <oval-def:criterion comment="telnet-server removed" test_ref="oval:ssg-service_telnet_disabled_test_service_telnet_package_telnet-server_removed:tst:1"/>
            <oval-def:criteria comment="service telnet is not configured to start" operator="AND">
              <oval-def:criterion comment="telnet is not running" test_ref="oval:ssg-test_service_not_running_service_telnet_disabled_telnet:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service telnet is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_telnet_disabled_telnet:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_ufw_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify ufw Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_ufw_enabled" source="ssg"/>
            <oval-def:description>The ufw service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package ufw installed and service ufw is configured to start" operator="AND">
            <oval-def:criterion comment="ufw installed" test_ref="oval:ssg-test_service_ufw_package_ufw_installed:tst:1"/>
            <oval-def:criteria comment="service ufw is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ufw is running" test_ref="oval:ssg-test_service_running_ufw:tst:1"/>
              <oval-def:criteria comment="service ufw is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants ufw" test_ref="oval:ssg-test_multi_user_wants_ufw:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ufw socket" test_ref="oval:ssg-test_multi_user_wants_ufw_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_usbguard_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable the USBGuard Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="service_usbguard_enabled" source="ssg"/>
            <oval-def:description>The usbguard service should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package usbguard installed and service usbguard is configured to start" operator="AND">
            <oval-def:criterion comment="usbguard installed" test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1"/>
            <oval-def:criteria comment="service usbguard is configured to start and is running" operator="AND">
              <oval-def:criterion comment="usbguard is running" test_ref="oval:ssg-test_service_running_usbguard:tst:1"/>
              <oval-def:criteria comment="service usbguard is configured to start" operator="OR">
                <oval-def:criterion comment="multi-user.target wants usbguard" test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants usbguard socket" test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-set_firewalld_default_zone:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Default firewalld Zone for Incoming Packets</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="set_firewalld_default_zone" source="ssg"/>
            <oval-def:description>Check presence of DefaultZone=drop in /etc/firewalld/firewalld.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus 0 extra definitions." operator="AND">
            <oval-def:criterion comment="Check that /etc/firewalld/firewalld.conf contains a line with certain text" test_ref="oval:ssg-test_set_firewalld_default_zone:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Allow Only SSH Protocol 2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_allow_only_protocol2" source="ssg"/>
            <oval-def:description>Ensure 'Protocol' is configured with value '2' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the Protocol in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
                  <oval-def:criterion comment="Check the Protocol in sshd_config includedif any" test_ref="oval:ssg-test_sshd_allow_only_protocol2_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_Protocol_present_sshd_allow_only_protocol2:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_compression:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Compression Or Set Compression to delayed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_compression" source="ssg"/>
            <oval-def:description>Ensure 'Compression' is configured with value configured in var_sshd_disable_compression variable in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the Compression in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_compression:tst:1"/>
                  <oval-def:criterion comment="Check the Compression in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_compression_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_Compression_present_sshd_disable_compression:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Access via Empty Passwords</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_empty_passwords" source="ssg"/>
            <oval-def:description>Ensure 'PermitEmptyPasswords' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1"/>
                  <oval-def:criterion comment="Check the PermitEmptyPasswords in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_empty_passwords_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PermitEmptyPasswords_present_sshd_disable_empty_passwords:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_gssapi_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable GSSAPI Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_gssapi_auth" source="ssg"/>
            <oval-def:description>Ensure 'GSSAPIAuthentication' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1"/>
                  <oval-def:criterion comment="Check the GSSAPIAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_gssapi_auth_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_GSSAPIAuthentication_present_sshd_disable_gssapi_auth:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_kerb_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kerberos Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_kerb_auth" source="ssg"/>
            <oval-def:description>Ensure 'KerberosAuthentication' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the KerberosAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1"/>
                  <oval-def:criterion comment="Check the KerberosAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_kerb_auth_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_KerberosAuthentication_present_sshd_disable_kerb_auth:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_pubkey_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable PubkeyAuthentication Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_pubkey_auth" source="ssg"/>
            <oval-def:description>Ensure 'PubkeyAuthentication' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1"/>
                  <oval-def:criterion comment="Check the PubkeyAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_pubkey_auth_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PubkeyAuthentication_present_sshd_disable_pubkey_auth:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_rhosts:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for .rhosts Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_rhosts" source="ssg"/>
            <oval-def:description>Ensure 'IgnoreRhosts' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the IgnoreRhosts in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1"/>
                  <oval-def:criterion comment="Check the IgnoreRhosts in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_rhosts_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_IgnoreRhosts_present_sshd_disable_rhosts:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for Rhosts RSA Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_rhosts_rsa" source="ssg"/>
            <oval-def:description>Ensure 'RhostsRSAAuthentication' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the RhostsRSAAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
                  <oval-def:criterion comment="Check the RhostsRSAAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_RhostsRSAAuthentication_present_sshd_disable_rhosts_rsa:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_root_login:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Root Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_root_login" source="ssg"/>
            <oval-def:description>Ensure 'PermitRootLogin' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_root_login:tst:1"/>
                  <oval-def:criterion comment="Check the PermitRootLogin in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_root_login_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PermitRootLogin_present_sshd_disable_root_login:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_root_password_login:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH root Login with a Password (Insecure)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_root_password_login" source="ssg"/>
            <oval-def:description>Ensure 'PermitRootLogin' is configured with value 'prohibit-password' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1"/>
                  <oval-def:criterion comment="Check the PermitRootLogin in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_root_password_login_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PermitRootLogin_present_sshd_disable_root_password_login:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_tcp_forwarding:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH TCP Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_tcp_forwarding" source="ssg"/>
            <oval-def:description>Ensure 'AllowTcpForwarding' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the AllowTcpForwarding in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1"/>
                  <oval-def:criterion comment="Check the AllowTcpForwarding in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_AllowTcpForwarding_present_sshd_disable_tcp_forwarding:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for User Known Hosts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_user_known_hosts" source="ssg"/>
            <oval-def:description>Ensure 'IgnoreUserKnownHosts' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
                  <oval-def:criterion comment="Check the IgnoreUserKnownHosts in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_user_known_hosts_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_IgnoreUserKnownHosts_present_sshd_disable_user_known_hosts:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_disable_x11_forwarding:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable X11 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_disable_x11_forwarding" source="ssg"/>
            <oval-def:description>Ensure 'X11Forwarding' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1"/>
                  <oval-def:criterion comment="Check the X11Forwarding in sshd_config includedif any" test_ref="oval:ssg-test_sshd_disable_x11_forwarding_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_X11Forwarding_present_sshd_disable_x11_forwarding:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Do Not Allow SSH Environment Options</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_do_not_permit_user_env" source="ssg"/>
            <oval-def:description>Ensure 'PermitUserEnvironment' is configured with value 'no' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PermitUserEnvironment in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1"/>
                  <oval-def:criterion comment="Check the PermitUserEnvironment in sshd_config includedif any" test_ref="oval:ssg-test_sshd_do_not_permit_user_env_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PermitUserEnvironment_present_sshd_do_not_permit_user_env:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_gssapi_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable GSSAPI Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_gssapi_auth" source="ssg"/>
            <oval-def:description>Ensure 'GSSAPIAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1"/>
                  <oval-def:criterion comment="Check the GSSAPIAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_gssapi_auth_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_GSSAPIAuthentication_present_sshd_enable_gssapi_auth:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_pam:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable PAM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_pam" source="ssg"/>
            <oval-def:description>Ensure 'UsePAM' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the UsePAM in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_pam:tst:1"/>
                  <oval-def:criterion comment="Check the UsePAM in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_pam_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_UsePAM_present_sshd_enable_pam:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_pubkey_auth:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Public Key Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_pubkey_auth" source="ssg"/>
            <oval-def:description>Ensure 'PubkeyAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_pubkey_auth:tst:1"/>
                  <oval-def:criterion comment="Check the PubkeyAuthentication in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_pubkey_auth_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PubkeyAuthentication_present_sshd_enable_pubkey_auth:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_strictmodes:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Use of Strict Mode Checking</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_strictmodes" source="ssg"/>
            <oval-def:description>Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the StrictModes in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1"/>
                  <oval-def:criterion comment="Check the StrictModes in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_strictmodes_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_StrictModes_present_sshd_enable_strictmodes:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_warning_banner:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_warning_banner" source="ssg"/>
            <oval-def:description>Ensure 'Banner' is configured with value '/etc/issue' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1"/>
                  <oval-def:criterion comment="Check the Banner in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_warning_banner_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_Banner_present_sshd_enable_warning_banner:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_warning_banner_net:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_warning_banner_net" source="ssg"/>
            <oval-def:description>Ensure 'Banner' is configured with value '/etc/issue.net' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_warning_banner_net:tst:1"/>
                  <oval-def:criterion comment="Check the Banner in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_warning_banner_net_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_Banner_present_sshd_enable_warning_banner_net:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_enable_x11_forwarding:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Encrypted X11 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_enable_x11_forwarding" source="ssg"/>
            <oval-def:description>Ensure 'X11Forwarding' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1"/>
                  <oval-def:criterion comment="Check the X11Forwarding in sshd_config includedif any" test_ref="oval:ssg-test_sshd_enable_x11_forwarding_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_X11Forwarding_present_sshd_enable_x11_forwarding:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_includes_config_files:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>sshd_includes_config_files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_includes_config_files" source="ssg"/>
            <oval-def:description>Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus 0 extra definitions." operator="AND">
            <oval-def:criterion comment="Check that /etc/ssh/sshd_config contains a line with certain text" test_ref="oval:ssg-test_sshd_includes_config_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_print_last_log:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Print Last Log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_print_last_log" source="ssg"/>
            <oval-def:description>Ensure 'PrintLastLog' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the PrintLastLog in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_print_last_log:tst:1"/>
                  <oval-def:criterion comment="Check the PrintLastLog in sshd_config includedif any" test_ref="oval:ssg-test_sshd_print_last_log_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_PrintLastLog_present_sshd_print_last_log:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_keepalive:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Count Max</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_keepalive" source="ssg"/>
            <oval-def:description>Ensure 'ClientAliveCountMax' is configured with value configured in var_sshd_set_keepalive variable in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the ClientAliveCountMax in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_set_keepalive:tst:1"/>
                  <oval-def:criterion comment="Check the ClientAliveCountMax in sshd_config includedif any" test_ref="oval:ssg-test_sshd_set_keepalive_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_keepalive_0:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Count Max to zero</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_keepalive_0" source="ssg"/>
            <oval-def:description>Ensure 'ClientAliveCountMax' is configured with value '0' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the ClientAliveCountMax in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1"/>
                  <oval-def:criterion comment="Check the ClientAliveCountMax in sshd_config includedif any" test_ref="oval:ssg-test_sshd_set_keepalive_0_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive_0:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_loglevel_info:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set LogLevel to INFO</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_loglevel_info" source="ssg"/>
            <oval-def:description>Ensure 'LogLevel' is configured with value 'INFO' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1"/>
                  <oval-def:criterion comment="Check the LogLevel in sshd_config includedif any" test_ref="oval:ssg-test_sshd_set_loglevel_info_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_LogLevel_present_sshd_set_loglevel_info:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_set_loglevel_verbose:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set SSH Daemon LogLevel to VERBOSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_set_loglevel_verbose" source="ssg"/>
            <oval-def:description>Ensure 'LogLevel' is configured with value 'VERBOSE' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1"/>
                  <oval-def:criterion comment="Check the LogLevel in sshd_config includedif any" test_ref="oval:ssg-test_sshd_set_loglevel_verbose_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_LogLevel_present_sshd_set_loglevel_verbose:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_use_priv_separation:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Use of Privilege Separation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_use_priv_separation" source="ssg"/>
            <oval-def:description>Ensure 'UsePrivilegeSeparation' is configured with value configured in var_sshd_priv_separation variable in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the UsePrivilegeSeparation in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1"/>
                  <oval-def:criterion comment="Check the UsePrivilegeSeparation in sshd_config includedif any" test_ref="oval:ssg-test_sshd_use_priv_separation_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_UsePrivilegeSeparation_present_sshd_use_priv_separation:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_x11_use_localhost:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent remote hosts from connecting to the proxy display</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_x11_use_localhost" source="ssg"/>
            <oval-def:description>Ensure 'X11UseLocalhost' is configured with value 'yes' in /etc/ssh/sshd_config</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:criteria comment="the configuration is correct if it exists" operator="AND">
                  <oval-def:criterion comment="Check the X11UseLocalhost in /etc/ssh/sshd_configif any" test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1"/>
                  <oval-def:criterion comment="Check the X11UseLocalhost in sshd_config includedif any" test_ref="oval:ssg-test_sshd_x11_use_localhost_sshd_included_files:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="the configuration exists" test_ref="oval:ssg-test_X11UseLocalhost_present_sshd_x11_use_localhost:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_enable_certmap:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Certmap in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sssd_enable_certmap" source="ssg"/>
            <oval-def:description>Check presence of \[certmap\/.+\/.+\] in /etc/sssd/sssd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Test conditions - presence of the file plus 0 extra definitions." operator="AND">
            <oval-def:criterion comment="Check that /etc/sssd/sssd.conf contains a line with certain text" test_ref="oval:ssg-test_sssd_enable_certmap:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_add_noexec:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_add_noexec" source="ssg"/>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="noexec is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_noexec_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_add_requiretty:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_add_requiretty" source="ssg"/>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="requiretty is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_requiretty_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_add_use_pty:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_add_use_pty" source="ssg"/>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="use_pty is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_use_pty_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sudo_custom_logfile:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure Sudo Logfile Exists - sudo logfile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sudo_custom_logfile" source="ssg"/>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="logfile is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_logfile_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_fifos:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on FIFOs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_fifos" source="ssg"/>
            <oval-def:description>The 'fs.protected_fifos' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_fifos configuration setting check" definition_ref="oval:ssg-sysctl_fs_protected_fifos_static:def:1"/>
            <oval-def:extend_definition comment="fs.protected_fifos runtime setting check" definition_ref="oval:ssg-sysctl_fs_protected_fifos_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_fifos_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on FIFOs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_fifos_runtime" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_fifos' parameter should be set to 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_fifos set to 2" test_ref="oval:ssg-test_sysctl_fs_protected_fifos_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_fifos_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on FIFOs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_fifos_static" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_fifos' parameter should be set to 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.protected_fifos set to 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_fifos_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter fs.protected_fifos missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_fifos_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_fifos set to 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_fifos_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/>
            <oval-def:description>The 'fs.protected_hardlinks' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_fs_protected_hardlinks_static:def:1"/>
            <oval-def:extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_fs_protected_hardlinks_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_hardlinks_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_hardlinks_runtime" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_hardlinks_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_hardlinks_static" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_hardlinks' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_hardlinks_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_regular:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Regular files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_regular" source="ssg"/>
            <oval-def:description>The 'fs.protected_regular' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_regular configuration setting check" definition_ref="oval:ssg-sysctl_fs_protected_regular_static:def:1"/>
            <oval-def:extend_definition comment="fs.protected_regular runtime setting check" definition_ref="oval:ssg-sysctl_fs_protected_regular_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_regular_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Regular files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_regular_runtime" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_regular' parameter should be set to 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_regular set to 2" test_ref="oval:ssg-test_sysctl_fs_protected_regular_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_regular_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Regular files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_regular_static" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_regular' parameter should be set to 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.protected_regular set to 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_regular_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter fs.protected_regular missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_regular_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_regular set to 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_regular_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/>
            <oval-def:description>The 'fs.protected_symlinks' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_fs_protected_symlinks_static:def:1"/>
            <oval-def:extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_fs_protected_symlinks_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_symlinks_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_symlinks_runtime" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_protected_symlinks_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_protected_symlinks_static" source="ssg"/>
            <oval-def:description>The kernel 'fs.protected_symlinks' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter fs.protected_symlinks missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_fs_protected_symlinks_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/>
            <oval-def:description>The 'fs.suid_dumpable' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_fs_suid_dumpable_static:def:1"/>
            <oval-def:extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_fs_suid_dumpable_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_suid_dumpable_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_suid_dumpable_runtime" source="ssg"/>
            <oval-def:description>The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_fs_suid_dumpable_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_fs_suid_dumpable_static" source="ssg"/>
            <oval-def:description>The kernel 'fs.suid_dumpable' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter fs.suid_dumpable missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_fs_suid_dumpable_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_pattern:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern" source="ssg"/>
            <oval-def:description>The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.core_pattern configuration setting check" definition_ref="oval:ssg-sysctl_kernel_core_pattern_static:def:1"/>
            <oval-def:extend_definition comment="kernel.core_pattern runtime setting check" definition_ref="oval:ssg-sysctl_kernel_core_pattern_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_pattern_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to |/bin/false in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.core_pattern set to |/bin/false" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_pattern_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to |/bin/false in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_core_pattern_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_uses_pid:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure file name of core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_uses_pid" source="ssg"/>
            <oval-def:description>The 'kernel.core_uses_pid' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.core_uses_pid configuration setting check" definition_ref="oval:ssg-sysctl_kernel_core_uses_pid_static:def:1"/>
            <oval-def:extend_definition comment="kernel.core_uses_pid runtime setting check" definition_ref="oval:ssg-sysctl_kernel_core_uses_pid_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_uses_pid_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure file name of core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_uses_pid_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_uses_pid' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.core_uses_pid set to 0" test_ref="oval:ssg-test_sysctl_kernel_core_uses_pid_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_core_uses_pid_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure file name of core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_core_uses_pid_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.core_uses_pid' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.core_uses_pid set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_core_uses_pid_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.core_uses_pid missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_core_uses_pid_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.core_uses_pid set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_core_uses_pid_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/>
            <oval-def:description>The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_kernel_dmesg_restrict_static:def:1"/>
            <oval-def:extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_kernel_dmesg_restrict_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_dmesg_restrict_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_dmesg_restrict_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_dmesg_restrict_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_dmesg_restrict_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.dmesg_restrict' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_dmesg_restrict_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_kexec_load_disabled" source="ssg"/>
            <oval-def:description>The 'kernel.kexec_load_disabled' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.kexec_load_disabled configuration setting check" definition_ref="oval:ssg-sysctl_kernel_kexec_load_disabled_static:def:1"/>
            <oval-def:extend_definition comment="kernel.kexec_load_disabled runtime setting check" definition_ref="oval:ssg-sysctl_kernel_kexec_load_disabled_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_kexec_load_disabled_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_kexec_load_disabled_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.kexec_load_disabled set to 1" test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_kexec_load_disabled_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_kexec_load_disabled_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.kexec_load_disabled' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_kexec_load_disabled_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/>
            <oval-def:description>The 'kernel.kptr_restrict' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_kernel_kptr_restrict_static:def:1"/>
            <oval-def:extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_kernel_kptr_restrict_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_kptr_restrict_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_kptr_restrict_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.kptr_restrict' parameter should be set to 1 or 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.kptr_restrict set to 1 or 2" test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_kptr_restrict_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_kptr_restrict_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.kptr_restrict' parameter should be set to 1 or 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 or 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 or 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_kptr_restrict_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_modules_disabled:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_modules_disabled" source="ssg"/>
            <oval-def:description>The 'kernel.modules_disabled' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.modules_disabled configuration setting check" definition_ref="oval:ssg-sysctl_kernel_modules_disabled_static:def:1"/>
            <oval-def:extend_definition comment="kernel.modules_disabled runtime setting check" definition_ref="oval:ssg-sysctl_kernel_modules_disabled_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_modules_disabled_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_modules_disabled_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.modules_disabled' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.modules_disabled set to 1" test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_modules_disabled_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_modules_disabled_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.modules_disabled' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.modules_disabled missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_modules_disabled_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_panic_on_oops:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Kernel panic on oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_panic_on_oops" source="ssg"/>
            <oval-def:description>The 'kernel.panic_on_oops' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.panic_on_oops configuration setting check" definition_ref="oval:ssg-sysctl_kernel_panic_on_oops_static:def:1"/>
            <oval-def:extend_definition comment="kernel.panic_on_oops runtime setting check" definition_ref="oval:ssg-sysctl_kernel_panic_on_oops_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_panic_on_oops_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Kernel panic on oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_panic_on_oops_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.panic_on_oops set to 1" test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_panic_on_oops_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Kernel panic on oops</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_panic_on_oops_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.panic_on_oops' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.panic_on_oops set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_panic_on_oops_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/>
            <oval-def:description>The 'kernel.perf_cpu_time_max_percent' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent_static:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_cpu_time_max_percent_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_cpu_time_max_percent_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/>
            <oval-def:description>The 'kernel.perf_event_max_sample_rate' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_kernel_perf_event_max_sample_rate_static:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_kernel_perf_event_max_sample_rate_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_max_sample_rate_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_max_sample_rate_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/>
            <oval-def:description>The 'kernel.perf_event_paranoid' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_kernel_perf_event_paranoid_static:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_kernel_perf_event_paranoid_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_event_paranoid_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_paranoid_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_perf_event_paranoid_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_paranoid_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.perf_event_paranoid' parameter should be set to 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_perf_event_paranoid_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_pid_max" source="ssg"/>
            <oval-def:description>The 'kernel.pid_max' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_kernel_pid_max_static:def:1"/>
            <oval-def:extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_kernel_pid_max_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_pid_max_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_pid_max_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.pid_max' parameter should be set to 65536 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_sysctl_kernel_pid_max_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_pid_max_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_pid_max_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.pid_max' parameter should be set to 65536 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_pid_max_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.pid_max missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_pid_max_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_pid_max_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/>
            <oval-def:description>The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_kernel_randomize_va_space_static:def:1"/>
            <oval-def:extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_kernel_randomize_va_space_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_randomize_va_space_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_randomize_va_space_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_randomize_va_space_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_randomize_va_space_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.randomize_va_space' parameter should be set to 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_randomize_va_space_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_sysrq" source="ssg"/>
            <oval-def:description>The 'kernel.sysrq' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_kernel_sysrq_static:def:1"/>
            <oval-def:extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_kernel_sysrq_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_sysrq_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_sysrq_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.sysrq' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_sysctl_kernel_sysrq_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_sysrq_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_sysrq_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.sysrq' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_sysrq_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.sysrq missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_sysrq_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_sysrq_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled" source="ssg"/>
            <oval-def:description>The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled configuration setting check" definition_ref="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_static:def:1"/>
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled runtime setting check" definition_ref="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled_accept_default" source="ssg"/>
            <oval-def:description>The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled configuration setting check" definition_ref="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_static:def:1"/>
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled runtime setting check" definition_ref="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 or 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1 or 2" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled_accept_default_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to 1 or 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 or 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameterkernel.unprivileged_bpf_disabled set to 1 or 2 or missing in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_pkg_not_wrong:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_yama_ptrace_scope" source="ssg"/>
            <oval-def:description>The 'kernel.yama.ptrace_scope' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.yama.ptrace_scope configuration setting check" definition_ref="oval:ssg-sysctl_kernel_yama_ptrace_scope_static:def:1"/>
            <oval-def:extend_definition comment="kernel.yama.ptrace_scope runtime setting check" definition_ref="oval:ssg-sysctl_kernel_yama_ptrace_scope_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_yama_ptrace_scope_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_yama_ptrace_scope_runtime" source="ssg"/>
            <oval-def:description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1" test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_yama_ptrace_scope_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_yama_ptrace_scope_static" source="ssg"/>
            <oval-def:description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_core_bpf_jit_harden" source="ssg"/>
            <oval-def:description>The 'net.core.bpf_jit_harden' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.core.bpf_jit_harden configuration setting check" definition_ref="oval:ssg-sysctl_net_core_bpf_jit_harden_static:def:1"/>
            <oval-def:extend_definition comment="net.core.bpf_jit_harden runtime setting check" definition_ref="oval:ssg-sysctl_net_core_bpf_jit_harden_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_core_bpf_jit_harden_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_core_bpf_jit_harden_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.core.bpf_jit_harden set to 2" test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_core_bpf_jit_harden_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_core_bpf_jit_harden_static" source="ssg"/>
            <oval-def:description>The kernel 'net.core.bpf_jit_harden' parameter should be set to 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_core_bpf_jit_harden_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_local:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Packets Routed Between Local Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_local" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.accept_local' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_local configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_local_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_local runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_local_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_local_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Packets Routed Between Local Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_local_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_local set to 0" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_local_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Packets Routed Between Local Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_local_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_local' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_local set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_redirects" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.accept_redirects' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_source_route" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.accept_source_route' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_source_route_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_source_route_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.accept_source_route' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure ARP filtering for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_filter" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.arp_filter' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_filter configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_filter runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure ARP filtering for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_filter_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.arp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure ARP filtering for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_filter_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_filter' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_filter set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_ignore" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.arp_ignore' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_ignore configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.arp_ignore runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_ignore_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.arp_ignore set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_arp_ignore_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.arp_ignore' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.arp_ignore set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.drop_gratuitous_arp' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.drop_gratuitous_arp configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.drop_gratuitous_arp runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.drop_gratuitous_arp' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.drop_gratuitous_arp' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_forwarding:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_forwarding" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.forwarding' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.forwarding configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.forwarding runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_forwarding_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.forwarding' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.forwarding set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_forwarding_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.forwarding' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.forwarding set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.forwarding missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.forwarding set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_log_martians" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.log_martians' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_log_martians_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_log_martians_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.log_martians' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_route_localnet" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.route_localnet' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.route_localnet configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.route_localnet runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_route_localnet_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.route_localnet set to 0" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_route_localnet_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_route_localnet_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.route_localnet' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.route_localnet set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_rp_filter" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.rp_filter' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_rp_filter_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to 1 or 2 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1 or 2" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_rp_filter_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.rp_filter' parameter should be set to 1 or 2 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to 1 or 2 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to 1 or 2 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_secure_redirects" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.secure_redirects' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_secure_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_secure_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.secure_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_send_redirects" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.send_redirects' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_send_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_send_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_shared_media" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.all.shared_media' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.shared_media configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.shared_media runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_shared_media_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.shared_media set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_shared_media_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.all.shared_media' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.shared_media set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_redirects" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.accept_redirects' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_source_route" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.accept_source_route' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_source_route_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_source_route_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.accept_source_route' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_log_martians" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.log_martians' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_log_martians_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_log_martians_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.log_martians' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_rp_filter" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.rp_filter' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_rp_filter_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_rp_filter_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.rp_filter' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_secure_redirects" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.secure_redirects' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_secure_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_secure_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.secure_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_send_redirects" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.send_redirects' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_send_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_send_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_shared_media" source="ssg"/>
            <oval-def:description>The 'net.ipv4.conf.default.shared_media' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.shared_media configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.shared_media runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_shared_media_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.shared_media set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Sending and Accepting Shared Media Redirects by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_shared_media_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.conf.default.shared_media' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.shared_media set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
            <oval-def:description>The 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.icmp_echo_ignore_broadcasts' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
            <oval-def:description>The 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.icmp_ignore_bogus_error_responses' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/>
            <oval-def:description>The 'net.ipv4.ip_forward' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_ip_forward_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_ip_forward_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_ip_forward_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_forward_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_ip_forward_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_forward_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.ip_forward' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_forward_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_local_port_range" source="ssg"/>
            <oval-def:description>The 'net.ipv4.ip_local_port_range' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.ip_local_port_range configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_ip_local_port_range_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.ip_local_port_range runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_ip_local_port_range_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_ip_local_port_range_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_local_port_range_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to 32768 65535 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_ip_local_port_range_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_local_port_range_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to 32768 65535 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_tcp_rfc1337:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_rfc1337" source="ssg"/>
            <oval-def:description>The 'net.ipv4.tcp_rfc1337' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.tcp_rfc1337 configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.tcp_rfc1337 runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_rfc1337_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.tcp_rfc1337' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.tcp_rfc1337 set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_rfc1337_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.tcp_rfc1337' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_rfc1337 set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_rfc1337 missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_rfc1337 set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_syncookies" source="ssg"/>
            <oval-def:description>The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.tcp_syncookies configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_static:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.tcp_syncookies runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_syncookies_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_syncookies_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv4.tcp_syncookies' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_defrtr set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_defrtr configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_defrtr runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_pinfo set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_pinfo configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_pinfo runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_rtr_pref set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_rtr_pref configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_rtr_pref runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_redirects" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_redirects' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_redirects set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_source_route" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_source_route' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_source_route set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_source_route_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_source_route' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_source_route_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_source_route' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_autoconf" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.autoconf set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.autoconf configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.autoconf runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_autoconf_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_autoconf_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_disable_ipv6_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_disable_ipv6_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IPv6 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_forwarding" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.forwarding' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.forwarding set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.forwarding configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.forwarding runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IPv6 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_forwarding_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.forwarding' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IPv6 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_forwarding_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.forwarding' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.forwarding missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_max_addresses" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.max_addresses set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.max_addresses configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.max_addresses runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_max_addresses_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_max_addresses_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_router_solicitations" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.router_solicitations set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.router_solicitations configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.router_solicitations runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_router_solicitations_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_router_solicitations_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_defrtr set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_defrtr configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_defrtr runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_pinfo set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_pinfo configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_pinfo runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_rtr_pref set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_rtr_pref configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_rtr_pref runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_redirects" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_redirects_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_redirects_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_source_route" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_source_route' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_source_route set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_source_route_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_source_route' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_source_route_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_source_route' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_autoconf" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.autoconf set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.autoconf configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.autoconf runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_autoconf_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_autoconf_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.disable_ipv6 set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_disable_ipv6_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_disable_ipv6_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to 1 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_max_addresses" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.max_addresses set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.max_addresses configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.max_addresses runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_max_addresses_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_max_addresses_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" version="4" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_router_solicitations" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.router_solicitations set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.router_solicitations configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.router_solicitations runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_router_solicitations_runtime" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_router_solicitations_static" source="ssg"/>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_user_max_user_namespaces:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_user_max_user_namespaces" source="ssg"/>
            <oval-def:description>The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="user.max_user_namespaces configuration setting check" definition_ref="oval:ssg-sysctl_user_max_user_namespaces_static:def:1"/>
            <oval-def:extend_definition comment="user.max_user_namespaces runtime setting check" definition_ref="oval:ssg-sysctl_user_max_user_namespaces_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_user_max_user_namespaces_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_user_max_user_namespaces_runtime" source="ssg"/>
            <oval-def:description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter user.max_user_namespaces set to 0" test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_user_max_user_namespaces_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_user_max_user_namespaces_static" source="ssg"/>
            <oval-def:description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter user.max_user_namespaces missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_user_max_user_namespaces_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_vm_mmap_min_addr" source="ssg"/>
            <oval-def:description>The 'vm.mmap_min_addr' kernel parameter should be set to the appropriate value in system configuration and system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="vm.mmap_min_addr configuration setting check" definition_ref="oval:ssg-sysctl_vm_mmap_min_addr_static:def:1"/>
            <oval-def:extend_definition comment="vm.mmap_min_addr runtime setting check" definition_ref="oval:ssg-sysctl_vm_mmap_min_addr_runtime:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_vm_mmap_min_addr_runtime:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_vm_mmap_min_addr_runtime" source="ssg"/>
            <oval-def:description>The kernel 'vm.mmap_min_addr' parameter should be set to 65536 in the system runtime.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_runtime:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_vm_mmap_min_addr_static:def:1" version="3" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_vm_mmap_min_addr_static" source="ssg"/>
            <oval-def:description>The kernel 'vm.mmap_min_addr' parameter should be set to 65536 in the system configuration.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_static_user:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr missing in sysctl files not managed by packages" test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_static_user_missing:tst:1"/>
              <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in sysctl files managed by packages" test_ref="oval:ssg-test_sysctl_vm_mmap_min_addr_static_pkg_correct:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-systemd_tmp_mount_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure tmp.mount Unit Is Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="systemd_tmp_mount_enabled" source="ssg"/>
            <oval-def:description>The tmp mount should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="mount tmp is configured to start and is running" operator="AND">
            <oval-def:criterion comment="tmp is running" test_ref="oval:ssg-test_mount_running_tmp:tst:1"/>
            <oval-def:criterion comment="multi-user.target wants tmp" test_ref="oval:ssg-test_multi_user_wants_tmp:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-timer_dnf-automatic_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable dnf-automatic Timer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="timer_dnf-automatic_enabled" source="ssg"/>
            <oval-def:description>The dnf-automatic timer should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package dnf-automatic installed and timer dnf-automatic is configured to start" operator="AND">
            <oval-def:extend_definition comment="dnf-automatic installed" definition_ref="oval:ssg-package_dnf-automatic_installed:def:1"/>
            <oval-def:criteria comment="timer dnf-automatic is configured to start and is running" operator="AND">
              <oval-def:criterion comment="dnf-automatic is running" test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1"/>
              <oval-def:criterion comment="multi-user.target wants dnf-automatic" test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-timer_logrotate_enabled:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Enable logrotate Timer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="timer_logrotate_enabled" source="ssg"/>
            <oval-def:description>The logrotate timer should be enabled if possible.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package logrotate installed and timer logrotate is configured to start" operator="AND">
            <oval-def:extend_definition comment="logrotate installed" definition_ref="oval:ssg-package_logrotate_installed:def:1"/>
            <oval-def:criteria comment="timer logrotate is configured to start and is running" operator="AND">
              <oval-def:criterion comment="logrotate is running" test_ref="oval:ssg-test_timer_running_logrotate:tst:1"/>
              <oval-def:criterion comment="multi-user.target wants logrotate" test_ref="oval:ssg-test_multi_user_wants_logrotate:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Check pam_pwquality Existence in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="accounts_password_pam_pwquality" source="ssg"/>
            <oval-def:description>Check that pam_pwquality.so exists in system-auth</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions for pam_pwquality are satisfied" test_ref="oval:ssg-test_password_pam_pwquality:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_auditctl:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_auditctl" source="ssg"/>
            <oval-def:description>Test if auditctl is in use for audit rules.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_auditctl:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_augenrules:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_augenrules" source="ssg"/>
            <oval-def:description>Test if augenrules is enabled for audit rules.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_augenrules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification_domainname" source="ssg"/>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit setdomainname" test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit setdomainname" test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit setdomainname" test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit setdomainname" test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification_hostname" source="ssg"/>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit sethostname" test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit augenrules 64-bit sethostname" test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit sethostname" test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition negate="true" comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
                <oval-def:criterion comment="audit auditctl 64-bit sethostname" test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_conf_log_file_not_set:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>'log_file' Not Set In /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_conf_log_file_not_set" source="ssg"/>
            <oval-def:description>Verify 'log_file' is not set in /etc/audit/auditd.conf.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Verify 'log_file' not set in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_conf_log_file_not_set:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="auditd_conf_log_group_not_root" source="ssg"/>
            <oval-def:description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1"/>
            <oval-def:criterion comment="Verify 'log_group' is set in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-bootc:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title/>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="bootc" source="ssg"/>
            <oval-def:description>Bootable container or bootc system</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel is installed" test_ref="oval:ssg-bootc_platform_test_kernel_installed:tst:1"/>
            <oval-def:criterion comment="rpm-ostree is installed" test_ref="oval:ssg-bootc_platform_test_rpm_ostree_installed:tst:1"/>
            <oval-def:criterion comment="bootc is installed" test_ref="oval:ssg-bootc_platform_test_bootc_installed:tst:1"/>
            <oval-def:criterion comment="openshift-kubelet is not installed" test_ref="oval:ssg-bootc_platform_test_openshift_kubelet_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Verify GRUB_DISABLE_RECOVERY Set to true</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="bootloader_disable_recovery_set_to_true" source="ssg"/>
            <oval-def:description>GRUB_DISABLE_RECOVERY set to 'true' in
      /etc/default/grub</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Specify Multiple Remote chronyd NTP Servers for Time Data</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="chronyd_specify_multiple_servers" source="ssg"/>
            <oval-def:description>Multiple chronyd NTP Servers for time synchronization should be specified.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met" operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ol7:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:7" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_ol7" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 7 System is installed" test_ref="oval:ssg-test_ol7_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ol8:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:8" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_ol8" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 8 System is installed" test_ref="oval:ssg-test_ol8_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ol9:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:9" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_ol9" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 9 System is installed" test_ref="oval:ssg-test_ol9_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is part of the Unix family</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="installed_OS_is_part_of_Unix_family" source="ssg"/>
            <oval-def:description>The operating system installed on the system is part of the Unix OS family</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux CoreOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux_coreos:4" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_rhcos4" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="RHCOS is installed" test_ref="oval:ssg-test_rhcos:tst:1"/>
              <oval-def:criterion comment="RHCOS version 4 is installed" test_ref="oval:ssg-test_rhcos4:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_rhel8:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_rhel8" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel8_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criteria comment="RHEL 8 is installed" operator="AND">
                <oval-def:criterion comment="RHEL 8 is installed" test_ref="oval:ssg-test_rhel8:tst:1"/>
                <oval-def:extend_definition negate="true" comment="Installed OS is not OL8" definition_ref="oval:ssg-installed_OS_is_ol8:def:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Red Hat Enterprise Virtualization Host is installed" operator="AND">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 8" test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_rhel9:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:9" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_rhel9" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel9_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criteria comment="RHEL 9 is installed" operator="AND">
                <oval-def:criterion comment="RHEL 9 is installed" test_ref="oval:ssg-test_rhel9:tst:1"/>
                <oval-def:extend_definition negate="true" comment="Installed OS is not OL9" definition_ref="oval:ssg-installed_OS_is_ol9:def:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="Red Hat Enterprise Virtualization Host is installed" operator="AND">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 9" test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_sle12:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 12</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:12" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:12" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_sle12" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle12_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 12 Desktop is installed" test_ref="oval:ssg-test_sle12_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 12 Server is installed" test_ref="oval:ssg-test_sle12_server:tst:1"/>
              <oval-def:criterion comment="SLES 12 for SAP Applications is installed" test_ref="oval:ssg-test_sles_12_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_sle15:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:15" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:15" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_sle15" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle15_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 15 Desktop is installed" test_ref="oval:ssg-test_sle15_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 15 Server is installed" test_ref="oval:ssg-test_sle15_server:tst:1"/>
              <oval-def:criterion comment="SLES 15 for SAP Applications is installed" test_ref="oval:ssg-test_sles_15_for_sap:tst:1"/>
              <oval-def:criterion comment="SUSE Manager 4 is installed" test_ref="oval:ssg-test_suma_4:tst:1"/>
              <oval-def:criterion comment="SLE HPC is installed" test_ref="oval:ssg-test_sle_hpc:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_slmicro5:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise Micro</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:suse-microos:5.2" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:sle-micro:5.3" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:sle-micro:5.4" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:sle-micro:5.5" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_slmicro5" source="ssg"/>
            <oval-def:description>The operating system installed on the system is
                SUSE Linux Enterprise Micro.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_slmicro5_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SUSE MicroOS 5.* is installed" test_ref="oval:ssg-test_slmicroos5:tst:1"/>
              <oval-def:criterion comment="SLE Micro 5.* is installed" test_ref="oval:ssg-test_slmicro5:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Ubuntu</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="installed_OS_is_ubuntu" source="ssg"/>
            <oval-def:description>The operating system installed is an Ubuntu System</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Ubuntu" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="lsb-based distrib" test_ref="oval:ssg-test_lsb:tst:1"/>
            <oval-def:criterion comment="Ubuntu is installed" test_ref="oval:ssg-test_ubuntu:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 16.04 LTS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:16.04" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_ubuntu1604" source="ssg"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 16.04 LTS</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Xenial" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Xenial is installed" test_ref="oval:ssg-test_ubuntu_xenial:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 18.04 LTS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:18.04" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_ubuntu1804" source="ssg"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 18.04 LTS</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Bionic" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Bionic is installed" test_ref="oval:ssg-test_ubuntu_bionic:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 20.04 LTS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:20.04" source="CPE"/>
            <oval-def:reference ref_id="installed_OS_is_ubuntu2004" source="ssg"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 20.04 LTS</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Focal" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Focal is installed" test_ref="oval:ssg-test_ubuntu_focal:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>No CD/DVD drive is configured to automount in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="no_cd_dvd_drive_in_etc_fstab" source="ssg"/>
            <oval-def:description>Check the /etc/fstab and check if a CD/DVD drive
      is not configured for automount.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if CD/DVD drive is not configured to automout in /etc/fstab" test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Device Files for Removable Media Partitions Does Not Exist on the System</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="removable_partition_doesnt_exist" source="ssg"/>
            <oval-def:description>Verify if device file representing removable partitions
      exist on the system</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if removable partition really exists on the system" test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_not_required_or_unset:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>SSHD is not required to be installed or requirement not set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_not_required_or_unset" source="ssg"/>
            <oval-def:description>If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH not required or not set" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_not_required:tst:1"/>
            <oval-def:extend_definition comment="SSH requirement is unset" definition_ref="oval:ssg-sshd_requirement_unset:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_required_or_unset:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>SSHD is required to be installed or requirement not set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_required_or_unset" source="ssg"/>
            <oval-def:description>If SSHD is required, we check it is installed. If SSH requirement is unset, we are good.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH required or not set" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_required:tst:1"/>
            <oval-def:extend_definition comment="SSH requirement is unset" definition_ref="oval:ssg-sshd_requirement_unset:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sshd_requirement_unset:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>It doesn't matter if sshd is installed or not</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sshd_requirement_unset" source="ssg"/>
            <oval-def:description>Test if value sshd_required is 0.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Kernel Runtime Parameter IPv6 Check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="sysctl_kernel_ipv6_disable" source="ssg"/>
            <oval-def:description>Disables IPv6 for all network interfaces.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_static:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_runtime:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_info_architecture_64bit:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Test for 64-bit Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="system_info_architecture_64bit" source="ssg"/>
            <oval-def:description>Generic test for 64-bit architectures to be used by other tests</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for aarch64 architecture" definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for s390x architecture" definition_ref="oval:ssg-system_info_architecture_s390_64:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_info_architecture_aarch_64:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Test for aarch_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="system_info_architecture_aarch_64" source="ssg"/>
            <oval-def:description>Generic test for aarch_64 architecture to be used by other tests</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Generic test for aarch_64 architecture" test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Test for PPC and PPCLE Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="system_info_architecture_ppc_64" source="ssg"/>
            <oval-def:description>Generic test for PPC PPC64LE architecture to be used by other tests</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
            <oval-def:criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_info_architecture_s390_64:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Test for s390_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="system_info_architecture_s390_64" source="ssg"/>
            <oval-def:description>Generic test for s390_64 architecture to be used by other tests</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Generic test for s390_64 architecture" test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_info_architecture_x86:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Test for x86 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="system_info_architecture_x86" source="ssg"/>
            <oval-def:description>Generic test for x86 architecture to be used by other tests</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_info_architecture_x86_64:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Test for x86_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="system_info_architecture_x86_64" source="ssg"/>
            <oval-def:description>Generic test for x86_64 architecture to be used by other tests</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Check that file storing USBGuard rules exists and is not empty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="usbguard_rules_not_empty_not_missing" source="ssg"/>
            <oval-def:description>Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that file storing USBGuard rules exists and is not empty" operator="AND">
            <oval-def:criterion comment="Check that the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non white space character." test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_accounts_user_umask' variable represented as octal number</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="var_accounts_user_umask_as_number" source="ssg"/>
            <oval-def:description>Value of 'var_accounts_user_umask' variable represented as octal number</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="var_removable_partition_is_cd_dvd_drive" source="ssg"/>
            <oval-def:description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if removable partition value represents CD/DVD drive" test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
      </oval-def:definitions>
      <oval-def:tests>
        <ind:textfilecontent54_test id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" check="all" comment="audit augenrules configuration locked" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ari_locked_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" check="all" comment="audit auditctl configuration locked" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ari_locked_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_augen_immutable_login_uids:tst:1" version="1" check="all" comment="test presence of --loginuid-immutable in some file in /etc/audit/rules.d/*.rules" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_augen_immutable_login_uids:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditctl_immutable_login_uids:tst:1" version="1" check="all" comment="test presence of --loginuid-immutable in some file in /etc/audit/audit.rules" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditctl_immutable_login_uids:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" check="all" comment="audit selinux changes augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" check="all" comment="audit selinux changes auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_augenrules_usr_share:tst:1" version="1" check="all" comment="audit selinux changes augenrules in usr/share" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules_usr_share:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_auditctl_usr_share:tst:1" version="1" check="all" comment="audit selinux changes auditctl in usr/share" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl_usr_share:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" check="all" comment="audit /etc/issue augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" check="all" comment="audit /etc/issue.net augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" check="all" comment="audit /etc/hosts augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" check="all" comment="audit /etc/sysconfig/network augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" check="all" comment="audit /etc/issue auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" check="all" comment="audit /etc/issue.net auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" check="all" comment="audit /etc/hosts auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" check="all" comment="audit /etc/sysconfig/network auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules utmp" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arse_utmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules btmp" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arse_btmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules wtmp" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arse_wtmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl utmp" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arse_utmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl btmp" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arse_btmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl wtmp" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arse_wtmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sudoers_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sudoers_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sudoers_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sudoers_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sudoers_d_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sudoers_d_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sudoers_d_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sudoers_d_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_uid_privileged_function_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit uid privileged function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_uid_privileged_function_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_uid_privileged_function_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit uid privileged function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_uid_privileged_function_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_uid_privileged_function_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit uid privileged function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_uid_privileged_function_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_uid_privileged_function_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit uid privileged_function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_uid_privileged_function_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_gid_privileged_function_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit gid privileged function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_gid_privileged_function_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_gid_privileged_function_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit gid privileged function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_gid_privileged_function_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_gid_privileged_function_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit gid privileged function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_gid_privileged_function_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_gid_privileged_function_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit gid privileged_function" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_gid_privileged_function_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ars_shutdown_augenrules:tst:1" version="1" check="at least one" comment="audit augenrules configuration shutdown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ars_shutdown_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_ars_shutdown:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ars_shutdown_auditctl:tst:1" version="1" check="all" comment="audit auditctl configuration shutdown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ars_shutdown_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_ars_shutdown:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/group" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/passwd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/gshadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/shadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/security/opasswd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" check="all" comment="audit /etc/group" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" check="all" comment="audit /etc/passwd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" check="all" comment="audit /etc/gshadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" check="all" comment="audit /etc/shadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" check="all" comment="audit /etc/security/opasswd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" check="all" comment="defined audit rule must exist" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" check="all" comment="defined audit rule must exist" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_group_ownership_default_var_log_audit_directories:tst:1" version="1" check="all" comment="/var/log/audit directories uid root gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_group_ownership_default_var_log_audit_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_group_ownership_var_log_audit_directories-non_root:tst:1" version="1" check="all" comment="/var/log/audit directories uid root gid root" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_group_ownership_var_log_audit_directories-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_group_ownership_var_log_audit_directories:tst:1" version="1" check="all" comment="/var/log/audit directories uid root gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_group_ownership_var_log_audit_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_user_ownership_var_log_audit_path:tst:1" version="1" check="all" comment="log_file's directory uid root gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_user_ownership_var_log_audit_path:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_user_ownership_var_log_audit_directories:tst:1" version="1" check="all" comment="/var/log/audit directories uid root gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_user_ownership_var_log_audit_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_dir_permissions_audit_log:tst:1" version="1" check="all" comment="/var/log/audit mode 0700" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_audit_log_directory:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" check="all" comment="/var/log/audit mode 0700" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_var_log_audit_directory:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0750" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_var_log_audit_directory-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_dir_permissions_audit_log-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0750" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_audit_log_directory-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_group_ownership_audit_log_files:tst:1" version="1" check="all" comment="audit log files gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_group_ownership_audit_log_files:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_group_ownership_default_audit_log_files:tst:1" version="1" check="all" comment="audit log files gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_group_ownership_default_audit_log_files:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" check="all" comment="/var/log/audit directories uid root gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" check="all" comment="/var/log/audit files uid root gid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" check="all" comment="/var/log/audit directories uid root gid root" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" check="all" comment="/var/log/audit files uid root gid root" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_audit_log:tst:1" version="1" check="all" comment="audit log files mode 0600" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_audit_log_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_default_audit_log:tst:1" version="1" check="all" comment="default audit log files mode 0600" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_audit_default_log_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit umount" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit umount" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit delete_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit delete_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit delete_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit delete_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit finit_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit finit_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit finit_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit finit_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit init_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit init_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit init_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit init_module" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_augenrules_all_priv_cmds_covered:tst:1" version="1" check="all" comment="There is one augenrules rule for each privileged command on the system." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_priv_cmds_from_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_priv_cmds_from_system:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_augenrules_all_priv_cmds_covered_bootc:tst:1" version="1" check="all" comment="There is one augenrules rule for each privileged command on the system." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_priv_cmds_from_augenrules_bootc:obj:1"/>
          <ind:state state_ref="oval:ssg-state_priv_cmds_from_system_bootc:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_augenrules_count_matches_system_priv_cmds:tst:1" version="1" check="all" comment="Count of augenrules for priv cmds matches the count of priv cmds in the system" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_priv_cmds_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_priv_cmds_from_augenrules_count:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_augenrules_count_matches_system_priv_cmds_bootc:tst:1" version="1" check="all" comment="Count of augenrules for priv cmds matches the count of priv cmds in the system" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_priv_cmds_count_bootc:obj:1"/>
          <ind:state state_ref="oval:ssg-state_priv_cmds_from_augenrules_count_bootc:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditctl_all_priv_cmds_covered:tst:1" version="1" check="all" comment="There is one auditctl rule for each privileged command on the system." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_priv_cmds_from_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_priv_cmds_from_system:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_auditctl_count_matches_system_priv_cmds:tst:1" version="1" check="all" comment="Count of auditctl rules for priv cmds matches the count of priv cmds in the system" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_priv_cmds_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_priv_cmds_from_auditctl_count:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit adjtimex" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit adjtimex" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit adjtimex" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit adjtimex" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit clock_settime" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit clock_settime" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit clock_settime" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit clock_settime" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit settimeofday" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit settimeofday" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit settimeofday" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit settimeofday" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit stime" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_stime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit stime" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_art_stime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" check="all" comment="audit /etc/localtime watch augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_artw_etc_localtime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" check="all" comment="audit /etc/localtime watch auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_artw_etc_localtime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" check="all" comment="audispd syslog plugin activated" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_error_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_error_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_error_action_stig_syslog:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_error_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_error_action_stig_syslog:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_error_action_stig_single:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_error_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_error_action_stig_single:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_error_action_stig_halt:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_error_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_error_action_stig_halt:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" check="all" comment="disk error action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_full_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_full_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_full_action_stig_syslog:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_full_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_full_action_stig_syslog:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_full_action_stig_single:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_full_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_full_action_stig_single:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_full_action_stig_halt:tst:1" version="1" check="all" comment="disk full action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_full_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_full_action_stig_halt:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" check="all" comment="email account for actions" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" check="all" comment="space left action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" check="all" comment="admin space left action " state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file_action_stig_rotate:tst:1" version="1" check="all" comment="admin space left action " state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action_stig_rotate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file_action_stig_single:tst:1" version="1" check="all" comment="admin space left action " state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action_stig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action_stig_single:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left:tst:1" version="1" check="all" comment="admin space left action " state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" check="all" comment="space left action" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" check="all" comment="admin space left action " state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_name_format:tst:1" version="1" check="all" comment="tests the value of name_format setting in the /etc/audit/auditd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_name_format:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_name_format:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_overflow_action:tst:1" version="1" check="all" comment="tests the value of overflow_action setting in the /etc/audit/auditd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_overflow_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_overflow_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_fapolicy_default_deny_policy_with_rulesd:tst:1" version="1" check="all" comment="fapolicyd employs a deny-all policy in compiled.rules file" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_fapolicy_default_deny_policy_compiled_rules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_fapolicy_default_deny_policy_without_rulesd:tst:1" version="2" check="all" comment="fapolicyd employs a deny-all policy in fapolicyd.rules file" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_fapolicy_default_deny_policy_fapolicyd_rules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_fapolicy_default_deny_enforcement:tst:1" version="2" check="all" comment="permissive mode is disabled in fapolicyd settings" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_fapolicy_default_deny_permissive_mode:obj:1"/>
          <ind:state state_ref="oval:ssg-state_fapolicy_default_deny_permissive_mode_off:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" check="all" comment="Check if root has the correct mail alias." state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_root_mail_alias:obj:1"/>
          <ind:state state_ref="oval:ssg-state_root_mail_alias:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_postfix_client_configure_mail_alias_postmaster:tst:1" version="1" check="all" comment="Check if postmaster has the correct mail alias" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_postmaster_mail_alias:obj:1"/>
          <ind:state state_ref="oval:ssg-state_postmaster_mail_alias:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_postfix_network_listening_disabled:tst:1" version="1" check="all" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_postfix_network_listening_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_postfix_network_listening_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_postfix_prevent_unrestricted_relay:tst:1" version="1" check="all" comment="tests the value of smtpd_client_restrictions setting in the /etc/postfix/main.cf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_postfix_prevent_unrestricted_relay:obj:1"/>
          <ind:state state_ref="oval:ssg-state_postfix_prevent_unrestricted_relay:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_postfix_prevent_unrestricted_relay_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/postfix/main.cf exists for postfix_prevent_unrestricted_relay" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_postfix_prevent_unrestricted_relay_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_use_kerberos_security_all_exports:tst:1" version="2" check="all" comment="Tests the value of the Kerberos Settings in /etc/exports" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_use_kerberos_security_all_exports:obj:1"/>
          <ind:state state_ref="oval:ssg-state_use_kerberos_security_all_exports:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_non_empty_exports_file:tst:1" version="1" check="all" comment="Tests if a share is configured in /etc/exports" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_non_empty_exports_file:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_client_only:tst:1" version="1" check="all" comment="check if port is 0 in /etc/chrony.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_chronyd_port_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_port_value_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chrony_remote_server_configuration:tst:1" version="1" check="all" comment="Ensure remote NTP server is set" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_chrony_remote_server_configuration:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chrony_remote_pool_configuration:tst:1" version="1" check="all" comment="Ensure remote NTP pool is set" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_chrony_remote_pool_configuration:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" check="all" comment="check if cmdport is 0 in /etc/chrony.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_chronyd_cmdport_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_cmdport_value_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" check="all" comment="check if maxpoll is set in /etc/ntp.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ntp_set_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" check="all" comment="check if maxpoll is set in /etc/chrony.conf or /etc/chrony.d/" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_chrony_set_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" check="all" comment="check if all server entries have maxpoll set in /etc/ntp.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" check="all" comment="check if all server entries have maxpoll set in /etc/chrony.conf or /etc/chrony.d/" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_user_override:tst:1" version="1" check="all" comment="The default chrony user hasn't been overriden" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_user_override:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_server_directive_with_server:tst:1" version="1" check="all" comment="Ensure at least one time source is set with server directive" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_chronyd_server_directive:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_server_directive_no_pool:tst:1" version="1" check="all" comment="Ensure no time source is set with pool directive" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_chronyd_no_pool_directive:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_remote_server:tst:1" version="1" check="all" comment="Ensure at least one NTP server is set" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_chronyd_remote_server:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:tst:1" version="1" check="all" comment="Test if /etc/nssswitch.conf contains 'altfiles' in 'group' key" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:obj:1"/>
          <ind:state state_ref="oval:ssg-state_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_chrony_keys:tst:1" version="1" check="all" comment="Testing group ownership of /etc/chrony.keys" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_chrony_keys:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_chrony_keys_with_usrlib:tst:1" version="1" check="all" comment="Testing group ownership of /etc/chrony.keys" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_chrony_keys_with_usrlib:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" check="all" comment="Ensure more than one ntpd NTP server is set" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_no_shosts_equiv:tst:1" version="1" check="all" comment="look for shosts.equiv in /" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_shosts_equiv_files_root:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" check="all" comment="look for .rhosts in /root" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" check="all" comment="look for .rhosts in /home" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" check="all" comment="look for /etc/hosts.equiv" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_no_shosts:tst:1" version="1" check="all" comment="look for .shosts in /" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_shosts_files_root:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tftpd_uses_secure_mode:tst:1" version="1" check="all" comment="tftpd secure mode" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tftpd_uses_secure_mode:obj:1"/>
          <ind:state state_ref="oval:ssg-state_tftpd_uses_secure_mode:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_snmp_versions:tst:1" version="1" check="all" comment="Check snmpd configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_no_offending_keys:tst:1" version="1" check="all" comment="No keys that have unsafe ownership/permissions combination exist" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_offending_keys:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ssh_client_rekey_limit_main_config:tst:1" version="1" check="all" comment="tests the value of RekeyLimit setting in /etc/ssh/ssh_config file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ssh_client_rekey_limit_main_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ssh_client_rekey_limit_include_configs:tst:1" version="1" check="all" comment="tests the value of RekeyLimit setting in /etc/ssh/ssh_config.d/*.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ssh_client_rekey_limit_include_configs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_sshd_port_enabled_zone_ssh_enabled_usr:tst:1" version="1" check="all" comment="SSH service is defined in all zones delivered in the firewalld package" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_sshd_port_enabled_zone_files_usr:obj:1"/>
        </ind:xmlfilecontent_test>
        <unix:file_test id="oval:ssg-test_firewalld_sshd_port_enabled_usr_zones_not_overridden:tst:1" version="1" check="all" comment="there is no equivalent zone file defined by the administrator in /etc dir" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_firewalld_sshd_port_enabled_customized_zone_files:obj:1"/>
        </unix:file_test>
        <ind:variable_test id="oval:ssg-test_firewalld_sshd_port_enabled_zone_ssh_enabled_etc:tst:1" version="1" check="all" comment="SSH service is defined in all zones created or modified by the administrator" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_firewalld_sshd_port_enabled_custom_zone_files_count:ste:1"/>
        </ind:variable_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_sshd_port_enabled_ssh_service_usr:tst:1" version="1" check="all" comment="SSH service is interger in the /usr/lib/firewalld/services dir" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_sshd_port_enabled_ssh_service_file_usr:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:textfilecontent54_test id="oval:ssg-test_firewalld_sshd_port_enabled_ssh_service_etc:tst:1" version="1" check="all" comment="SSH service is properly configured in /etc/firewalld/services dir" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_sshd_port_enabled_ssh_service_file_etc:obj:1"/>
          <ind:state state_ref="oval:ssg-state_firewalld_sshd_port_enabled_ssh_service_file_etc:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_include_crypto_policy_include_sshd_drop_in:tst:1" version="1" check="all" comment="Ensure that drop in config files are included" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_include_crypto_policy_include_sshd_drop_in:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_include_crypto_policy_include_sshd_include_system_crypto:tst:1" version="1" check="all" comment="Ensure that drop in config files are included" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_include_crypto_policy_include_sshd_include_system_crypto:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_allow_user_is_configured:tst:1" version="1" check="all" comment="Check if there is an AllowUsers entry" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_allow_user:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_allow_group_is_configured:tst:1" version="1" check="all" comment="Check if there is an AllowGroups entry" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_allow_group:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_deny_user_is_configured:tst:1" version="1" check="all" comment="Check if there is a DenyUsers entry" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_deny_user:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_deny_group_is_configured:tst:1" version="1" check="all" comment="Check if there is a DenyGroups entry" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_deny_group:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" check="all" comment="tests the value of RekeyLimit setting in the file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_rekey_limit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_rekey_limit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" check="all" comment="timeout is configured" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_clientaliveinterval_present:tst:1" version="1" check="all" comment="Verify that the value of ClientAliveInterval is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_idle_timeout:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_login_grace_time:tst:1" version="1" check="all" comment="LoginGraceTime is configured" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_login_grace_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_logingracetime_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_logingracetime_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_LoginGraceTime_present_sshd_set_login_grace_time:tst:1" version="1" check="all" comment="Verify that the value of LoginGraceTime is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_login_grace_time:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" check="all" comment="MaxAuthTries is configured" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_max_auth_tries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxauthtries_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_maxauthtries_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_MaxAuthTries_present_sshd_set_max_auth_tries:tst:1" version="1" check="all" comment="Verify that the value of MaxAuthTries is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_max_auth_tries:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_max_sessions:tst:1" version="1" check="all" comment="MaxSessions is configured" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_max_sessions:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxsessions_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_maxsessions_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_MaxSessions_present_sshd_set_max_sessions:tst:1" version="1" check="all" comment="Verify that the value of MaxSessions is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_max_sessions:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="2" check="all" comment="SSH MaxStartups start parameter is less than or equal to the expected value" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="2" check="all" comment="SSH MaxStartups rate parameter is greater than or equal to the expected value" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="2" check="all" comment="SSH MaxStartups full parameter is less than or equal to the expected value" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" check="all" comment="tests the absence of match setting in the /etc/ssh/sshd_config file" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_sshd_use_strong_macs:tst:1" version="1" check="at least one" comment="tests the value of MACs setting in the /etc/ssh/sshd_config file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_use_strong_macs:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_use_strong_macs:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" check="all" comment="test the value of         certificate_verification in sssd configuration" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_certificate_verification:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_certificate_verification:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_enable_pam_services:tst:1" version="1" check="all" comment="check if pam is configured in the services setting of the sssd section" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_pam_services:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_enable_pam_services:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" check="all" comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_smartcards:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_enable_smartcards:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_enable_smartcards_allow_missing_name_smartcard_auth:tst:1" version="2" check="all" comment="tests the presence of try_cert_auth or require_cert_auth in /etc/pam.d/smartcard-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_smartcards_smartcard_auth_options:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_enable_smartcards_allow_missing_name:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_enable_smartcards_cert_auth_system_auth:tst:1" version="2" check="all" comment="tests the presence of try_cert_auth or require_cert_auth in /etc/pam.d/system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_smartcards_system_auth_options:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_enable_smartcards_cert_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" check="all" comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_offline_cred_expiration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_offline_cred_expiration:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_cache_credentials:tst:1" version="1" check="all" comment="tests the value of cache_credentials setting in the /etc/sssd/sssd.conf file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_cache_credentials:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_cache_credentials:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_ldap_tls_reqcert:tst:1" version="1" check="all" comment="Ensures that LDAP TLS requires certificate is set" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sssd_ldap_tls_reqcert:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_ldap_tls_reqcert:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_use_starttls:tst:1" version="1" check="all" comment="Ensures that LDAP uses STARTTLS" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_use_starttls_sssd_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_use_starttls_sssd_conf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" check="all" comment="tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_usbguard_auditbackend:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test id="oval:ssg-package_xorg-x11-server-Xorg_removed:tst:1" version="1" check="all" comment="package xorg-x11-server-Xorg is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_package_xorg-x11-server-Xorg_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-package_xorg-x11-server-utils_removed:tst:1" version="1" check="all" comment="package xorg-x11-server-utils is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_package_xorg-x11-server-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-package_xorg-x11-server-Xwayland_removed:tst:1" version="1" check="all" comment="package xorg-x11-server-Xwayland is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_package_xorg-x11-server-Xwayland_removed:obj:1"/>
        </linux:rpminfo_test>
        <unix:symlink_test id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" check="all" comment="default.target systemd softlink exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_disable_xwindows_runlevel_target:obj:1"/>
          <unix:state state_ref="oval:ssg-state_disable_xwindows_runlevel_target:ste:1"/>
        </unix:symlink_test>
        <unix:symlink_test id="oval:ssg-test_pam_fingerprint_symlinked_to_authselect:tst:1" version="1" check="all" comment="The 'fingerprint-auth' PAM config is a symlink to its authselect counterpart" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_pam_fingerprint_symlinked_to_authselect:obj:1"/>
          <unix:state state_ref="oval:ssg-state_pam_fingerprint_symlinked_to_authselect:ste:1"/>
        </unix:symlink_test>
        <unix:symlink_test id="oval:ssg-test_pam_password_symlinked_to_authselect:tst:1" version="1" check="all" comment="The 'password-auth' PAM config is a symlink to its authselect counterpart" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_pam_password_symlinked_to_authselect:obj:1"/>
          <unix:state state_ref="oval:ssg-state_pam_password_symlinked_to_authselect:ste:1"/>
        </unix:symlink_test>
        <unix:symlink_test id="oval:ssg-test_pam_postlogin_symlinked_to_authselect:tst:1" version="1" check="all" comment="The 'postlogin' PAM config is a symlink to its authselect counterpart" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_pam_postlogin_symlinked_to_authselect:obj:1"/>
          <unix:state state_ref="oval:ssg-state_pam_postlogin_symlinked_to_authselect:ste:1"/>
        </unix:symlink_test>
        <unix:symlink_test id="oval:ssg-test_pam_smartcard_symlinked_to_authselect:tst:1" version="1" check="all" comment="The 'smartcard-auth' PAM config is a symlink to its authselect counterpart" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_pam_smartcard_symlinked_to_authselect:obj:1"/>
          <unix:state state_ref="oval:ssg-state_pam_smartcard_symlinked_to_authselect:ste:1"/>
        </unix:symlink_test>
        <unix:symlink_test id="oval:ssg-test_pam_system_symlinked_to_authselect:tst:1" version="1" check="all" comment="The 'system-auth' PAM config is a symlink to its authselect counterpart" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_pam_system_symlinked_to_authselect:obj:1"/>
          <unix:state state_ref="oval:ssg-state_pam_system_symlinked_to_authselect:ste:1"/>
        </unix:symlink_test>
        <ind:textfilecontent54_test id="oval:ssg-test_banner_etc_issue:tst:1" version="1" check="at least one" comment="correct banner in /etc/issue" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_issue:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_banner_etc_issue_net:tst:1" version="1" check="at least one" comment="correct banner in /etc/issue.net" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_banner_etc_issue_net:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_issue_net:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_banner_etc_motd_exists:tst:1" version="1" check="all" comment="/etc/motd exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_banner_etc_motd_exists:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_banner_etc_motd:tst:1" version="1" check="all" comment="correct banner in /etc/motd" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_banner_etc_motd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_motd:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_banner_gui_enabled:tst:1" version="1" check="all" comment="GUI banner is enabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_banner_gui_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" check="all" comment="GUI banner cannot be changed by user" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" check="all" comment="GUI banner cannot be changed by user" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_banner_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" check="all" comment="login banner text is correctly set" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_gdm_login_banner_text_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gdm_login_banner_text_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disallow_bypass_password_sudo:tst:1" version="1" check="all" comment="Check absence of conf pam_succeed_if in /etc/pam.d/sudo" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disallow_bypass_password_sudo:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_display_login_attempts:tst:1" version="2" check="all" comment="Check the pam_lastlog is configured to show last login information" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_password_auth_pam_unix_auth:tst:1" version="1" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_password_auth_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_password_auth_pam_faillock_auth:tst:1" version="1" check="all" comment="One and only one occurrence is expected in auth section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_password_auth_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_password_auth_pam_faillock_account:tst:1" version="1" check="all" comment="One and only one occurrence is expected in auth section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_password_auth_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_system_auth_pam_unix_auth:tst:1" version="1" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_system_auth_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_system_auth_pam_faillock_auth:tst:1" version="1" check="all" comment="One and only one occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_system_auth_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_system_auth_pam_faillock_account:tst:1" version="1" check="all" comment="One and only one occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_system_auth_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:selinuxsecuritycontext_test id="oval:ssg-test_account_password_selinux_faillock_dir:tst:1" version="2" check="all" comment="faillog_t context is set in pam_faillock.so tally directories" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_account_password_selinux_faillock_dir:obj:1"/>
          <linux:state state_ref="oval:ssg-state_account_password_selinux_faillock_dir:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <ind:variable_test id="oval:ssg-test_account_password_selinux_faillock_dir_not_set:tst:1" version="1" check="all" comment="Check the existence of faillock tally dirs" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_account_password_selinux_faillock_dir_not_set:obj:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_account_pam_faillock_audit_parameter_system_auth:tst:1" version="1" check="all" comment="Check the presence of audit parameter in system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_account_pam_faillock_audit_parameter_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_account_pam_faillock_audit_parameter_no_pamd_system:tst:1" version="1" check="all" comment="Check the absence of audit parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_account_pam_faillock_audit_parameter_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_account_pam_faillock_audit_parameter_password_auth:tst:1" version="1" check="all" comment="Check the presence of audit parameter in password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_account_pam_faillock_audit_parameter_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_account_pam_faillock_audit_parameter_no_pamd_password:tst:1" version="1" check="all" comment="Check the absence of audit parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_account_pam_faillock_audit_parameter_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_account_pam_faillock_audit_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected audit value in in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_account_pam_faillock_audit_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_account_pam_faillock_audit_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of audit parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_account_pam_faillock_audit_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" check="all" comment="Check pam_pwhistory.so presence in /etc/pam.d/password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pamd:tst:1" version="1" check="all" comment="Check remember parameter is present and correct in /etc/pam.d/password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pwhistory_conf:tst:1" version="1" check="all" comment="Check the absence of remember parameter in /etc/security/pwhistory.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_param_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pamd:tst:1" version="1" check="all" comment="Check remember parameter is absent in /etc/pam.d/password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pwhistory_conf:tst:1" version="1" check="all" comment="Check remember parameter is present and correct in /etc/security/pwhistory.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_param_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" check="all" comment="Check pam_pwhistory.so presence in /etc/pam.d/system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pamd:tst:1" version="1" check="all" comment="Check remember parameter is present and correct in /etc/pam.d/system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pwhistory_conf:tst:1" version="1" check="all" comment="Check the absence of remember parameter in /etc/security/pwhistory.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_param_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pamd:tst:1" version="1" check="all" comment="Check remember parameter is absent in /etc/pam.d/system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pwhistory_conf:tst:1" version="1" check="all" comment="Check remember parameter is present and correct in /etc/security/pwhistory.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_param_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" check="all" comment="Check pam_pwhistory.so presence in PAM file" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember_pamd:tst:1" version="1" check="all" comment="Check remember parameter is present and correct in PAM file" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember_pamd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember_no_pwhistory_conf:tst:1" version="1" check="all" comment="Check the absence of remember parameter in /etc/security/pwhistory.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember_param_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember_no_pamd:tst:1" version="1" check="all" comment="Check remember parameter is absent in PAM file" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember_pamd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember_pwhistory_conf:tst:1" version="1" check="all" comment="Check remember parameter is present and correct in /etc/security/pwhistory.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember_param_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember_legacy:tst:1" version="1" check="all" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember_legacy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_audit_parameter_system_auth:tst:1" version="1" check="all" comment="Check the presence of audit parameter in system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_pam_faillock_audit_parameter_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_audit_parameter_no_pamd_system:tst:1" version="1" check="all" comment="Check the absence of audit parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_pam_faillock_audit_parameter_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_audit_parameter_password_auth:tst:1" version="1" check="all" comment="Check the presence of audit parameter in password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_pam_faillock_audit_parameter_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_audit_parameter_no_pamd_password:tst:1" version="1" check="all" comment="Check the absence of audit parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_pam_faillock_audit_parameter_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_audit_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected audit value in in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_pam_faillock_audit_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_audit_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of audit parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_pam_faillock_audit_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:tst:1" version="1" check="all" comment="No more than one pam_unix.so is expected in auth section of system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:tst:1" version="1" check="all" comment="No more than one pam_unix.so is expected in auth section of password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:tst:1" version="1" check="all" comment="One and only one pattern occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:tst:1" version="1" check="all" comment="One and only one pattern occurrence is expected in account section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:tst:1" version="1" check="all" comment="One and only one pattern occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:tst:1" version="1" check="all" comment="One and only one pattern occurrence is expected in account section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:tst:1" version="1" check="all" comment="Check the expected even_deny_root parameter in system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_system:tst:1" version="1" check="all" comment="Check the absence of even_deny_root parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:tst:1" version="1" check="all" comment="Check the expected even_deny_root parameter in password-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_pamd_password:tst:1" version="1" check="all" comment="Check the absence of even_deny_root parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected even_deny_root parameter in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_root_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of even_deny_root parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_pam_faillock_dir_parameter_system_auth:tst:1" version="1" check="all" comment="Check that the expected dir value in system-auth is present both with preauth and       authfail" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_dir_parameter_system_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_pam_faillock_dir_parameter_system_auth:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_dir_parameter_no_pamd_system:tst:1" version="1" check="all" comment="Check the absence of dir parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_pam_faillock_dir_parameter_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_pam_faillock_dir_parameter_password_auth:tst:1" version="1" check="all" comment="Check that the expected dir value in password-auth is present both with preauth and       authfail" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_pam_faillock_dir_parameter_password_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_pam_faillock_dir_parameter_password_auth:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_dir_parameter_no_pamd_password:tst:1" version="1" check="all" comment="Check the absence of dir parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_all_pam_faillock_dir_parameter_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_dir_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected dir value in in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_pam_faillock_dir_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_pam_faillock_dir_parameter_not_default_value:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_dir_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of dir parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_pam_faillock_dir_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_enforce_for_root:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_enforce_for_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwquality_password_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwquality_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwquality_system_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwquality_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_password_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_password_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_password_auth_not_set:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_password_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_system_auth_not_set:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1" version="1" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_set_password_hashing_algorithm_libuserconf:tst:1" version="2" check="all" comment="check if /etc/libuser.conf hashing algorithm option is correct" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_set_password_hashing_algorithm_libuserconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_set_password_hashing_algorithm_libuserconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_set_password_hashing_algorithm_logindefs:tst:1" version="1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_set_password_hashing_algorithm_logindefs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_set_password_hashing_algorithm_logindefs:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_set_password_hashing_algorithm_passwordauth:tst:1" version="2" check="all" comment="check if pam_unix.so hashing algorithm option is correct and specified only once in /etc/pam.d/password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_set_password_hashing_algorithm_passwordauth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_set_password_hashing_algorithm_passwordauth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_unix_hashing_algorithm_systemauth:tst:1" version="2" check="all" comment="check if pam_unix.so hashing algorithm option is correct and specified only once in /etc/pam.d/system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_pam_unix_hashing_algorithm_systemauth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_pam_unix_hashing_algorithm_systemauth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_login_defs_sha_crypt_min_rounds_default:tst:1" version="1" check="all" comment="SHA_CRYPT_MIN_ROUNDS is not explicitly configured in /etc/login.defs and therefore takes on the default value" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_login_defs_sha_crypt_min_rounds_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_login_defs_sha_crypt_min_rounds_present:tst:1" version="1" check="all" comment="SHA_CRYPT_MIN_ROUNDS is explicitly configured in /etc/login.defs and its value most be greater or equal to 5000" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_login_defs_sha_crypt_min_rounds_present:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_login_defs_sha_crypt_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_login_defs_sha_crypt_max_rounds_default:tst:1" version="1" check="all" comment="SHA_CRYPT_MAX_ROUNDS is not explicitly configured in /etc/login.defs and therefore takes on the default value" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_login_defs_sha_crypt_max_rounds_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_login_defs_sha_crypt_max_rounds_present:tst:1" version="1" check="all" comment="SHA_CRYPT_MAX_ROUNDS is explicitly configured in /etc/login.defs and its value most be greater or equal to 5000" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_login_defs_sha_crypt_max_rounds_present:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_login_defs_sha_crypt_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_var_password_hashing_min_rounds_login_defs_le_5000:tst:1" version="1" check="all" comment="Check if the variable is set to 5000 or lower" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_password_hashing_min_rounds_login_defs_le_5000:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_password_hashing_min_rounds_login_defs_le_5000:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_ctrlaltdel_burstaction:tst:1" version="1" check="all" comment="check if CtrlAltDelBurstAction is set to none" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_ctrlaltdel_burstaction:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:symlink_test id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" check="all" comment="Disable Ctrl-Alt-Del key sequence override exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_disable_ctrlaltdel_exists:obj:1"/>
          <unix:state state_ref="oval:ssg-state_disable_ctrlaltdel_exists:ste:1"/>
        </unix:symlink_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" check="all" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" check="all" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_logind_session_timeout:tst:1" version="1" check="all" comment="tests the value of StopIdleSessionSec setting in the /etc/systemd/logind.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_logind_session_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_logind_session_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_logind_session_timeout_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/systemd/logind.conf exists for logind_session_timeout" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_logind_session_timeout_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_require_emergency_service:tst:1" version="1" check="all" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd emergency.service to ensure that a     password must be entered to access single user mode" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_require_emergency_service:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" check="all" comment="Tests that the systemd emergency.service is in the emergency.target" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_require_emergency_service_emergency:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" check="all" comment="look for emergency.service in /etc/systemd/system" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_custom_emergency_service:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" check="all" comment="look for emergency.target in /etc/systemd/system" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_custom_emergency_target:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_require_emergency_target_auth_drop_in_config_exist:tst:1" version="1" check="all" comment="Look for drop in config files for emergency.service" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_require_emergency_target_auth_drop_in_config_exist:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_require_rescue_service_distro:tst:1" version="1" check="all" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd rescue.service to ensure that a   password must be entered to access single user mode" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service_distro:obj:1"/>
          <ind:state state_ref="oval:ssg-state_require_rescue_service:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_require_rescue_service_override:tst:1" version="1" check="all" comment="Tests that/usr/lib/systemd/systemd-sulogin-shell     is defined in /etc/systemd/system/rescue.service.d/*.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service_override:obj:1"/>
          <ind:state state_ref="oval:ssg-state_require_rescue_service:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rescue_service_not_overridden:tst:1" version="1" check="all" comment="Check that there is no override file for rescue.service with Execstart - directive" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service_override:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" check="all" comment="Check that card_drivers is configured for opensc" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_opensc_card_drivers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_opensc_card_drivers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" check="all" comment="There should not exist duplicate user ids in /etc/passwd" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_count_of_all_uids:obj:1"/>
          <ind:state state_ref="oval:ssg-state_no_duplicate_uids:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check="all" comment="query /etc/passwd" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_authorized_local_users:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_authorized_local_users:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1" version="1" check="all" comment="There should not exist duplicate group ids in /etc/passwd" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_count_of_all_group_ids:obj:1"/>
          <ind:state state_ref="oval:ssg-state_no_duplicate_group_ids:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_auth_inactive:tst:1" version="1" check="all" comment="the value for the inactive parameter should be set appropriately in /etc/pam.d/password-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_auth_inactive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_inactive:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_inactive_positive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_system_auth_inactive:tst:1" version="1" check="all" comment="the value for the inactive parameter should be set appropriately in /etc/pam.d/system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_system_auth_inactive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_inactive:ste:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_inactive_positive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
          <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" check="all" comment="There should not exist duplicate user name entries in /etc/passwd" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" version="1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" version="1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" version="1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing:tst:1" version="1" check="all" comment="Compares a specific field in /etc/shadow with a specific variable value" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing:obj:1"/>
          <ind:state state_ref="oval:ssg-state_test_accounts_password_set_max_life_existing_password_max_life_existing:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:tst:1" version="1" check="all" comment="Compares a specific field in /etc/shadow with a specific variable value" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:obj:1"/>
          <ind:state state_ref="oval:ssg-state_test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_max_life_existing_password_max_life_not_empty:tst:1" version="1" check="all" comment="Passwords must have the maximum password age set non-empty in /etc/shadow." check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_set_max_life_existing_shadow_password_users_max_life_not_existing:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:shadow_test id="oval:ssg-test_accounts_password_set_max_life_root:tst:1" version="1" check="all" comment="root max age" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_password_set_max_life_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_password_set_max_life_root:ste:1"/>
        </unix:shadow_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_existing:tst:1" version="1" check="all" comment="Compares a specific field in /etc/shadow with a specific variable value" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_accounts_password_set_min_life_existing_password_max_life_existing:obj:1"/>
          <ind:state state_ref="oval:ssg-state_test_accounts_password_set_min_life_existing_password_max_life_existing:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:tst:1" version="1" check="all" comment="Compares a specific field in /etc/shadow with a specific variable value" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:obj:1"/>
          <ind:state state_ref="oval:ssg-state_test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_min_life_existing_password_max_life_not_empty:tst:1" version="1" check="all" comment="Passwords must have the maximum password age set non-empty in /etc/shadow." check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_set_min_life_existing_shadow_password_users_max_life_not_existing:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_warn_age_existing:tst:1" version="1" check="all" comment="Compares a specific field in /etc/shadow with a specific variable value" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_accounts_password_set_warn_age_existing:obj:1"/>
          <ind:state state_ref="oval:ssg-state_test_accounts_password_set_warn_age_existing:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_set_warn_age_existing_no_pass:tst:1" version="1" check="all" comment="Check the inexistence of users with a password defined" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_set_warn_age_existing_no_pass:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" version="1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_set_post_pw_existing:tst:1" version="1" check="all" comment="Compares a specific field in /etc/shadow with a specific variable value" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_accounts_set_post_pw_existing:obj:1"/>
          <ind:state state_ref="oval:ssg-state_test_accounts_set_post_pw_existing:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_set_post_pw_existing_no_pass:tst:1" version="1" check="all" comment="Check the inexistence of users with a password defined" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_set_post_pw_existing_no_pass:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:password_test id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" check="all" comment="password hashes are shadowed" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
        </unix:password_test>
        <unix:shadow_test id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" check="all" comment="password hashes are shadowed using sha512" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed_sha512_hidepass:ste:1"/>
        </unix:shadow_test>
        <ind:variable_test id="oval:ssg-test_accounts_password_last_change_is_in_past:tst:1" version="1" check="all" comment="Check if the password last chage time is less than or equal today." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_password_last_change_is_in_past_time_diff:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_last_change_is_in_past_time_diff:ste:1"/>
        </ind:variable_test>
        <unix:shadow_test id="oval:ssg-test_accounts_password_last_change_is_in_past_no_pass:tst:1" version="1" check="all" comment="Check the inexistence of users with a password defined" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_password_last_change_is_in_past:obj:1"/>
        </unix:shadow_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" check="all" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/password-auth " check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_pam_unix_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" check="all" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_pam_unix_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" check="all" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_empty_passwords:tst:1" version="1" check="all" comment="make sure nullok is not used in /etc/pam.d/system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_empty_passwords_etc_shadow:tst:1" version="1" check="all" comment="make sure there aren't blank or null passwords in /etc/shadow" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_no_netrc_files_home:tst:1" version="1" check="all" comment="look for .netrc in /home" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" check="all" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_root_gid_zero:tst:1" version="1" check="all" comment="test that the root user has GID 0 in the /etc/passwd file" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_root_gid_zero:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_root_gid_zero:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ensure_pam_wheel_group_empty_group_exists:tst:1" version="1" check="at least one" comment="check if group in var_pam_wheel_group_for_su variable used by pam_wheel.so exists" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ensure_pam_wheel_group_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ensure_pam_wheel_group_empty_has_no_members:tst:1" version="1" check="at least one" comment="check if group defined by pam_wheel.so group option has no members" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ensure_pam_wheel_group_exists:obj:1"/>
          <ind:state state_ref="oval:ssg-state_ensure_pam_wheel_group_has_no_members:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_root_password_etc_shadow:tst:1" version="1" check="all" comment="make sure root password is set in /etc/shadow" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_root_password_etc_shadow:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_securetty_exists:tst:1" version="1" check="all" comment="/etc/securetty file exists" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_direct_root_logins:tst:1" version="1" check="all" comment="no entries in /etc/securetty" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:shadow_test id="oval:ssg-test_no_password_auth_for_systemaccounts:tst:1" version="1" check="all" comment="system accounts with a password defined" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_password_auth_for_systemaccounts:obj:1"/>
        </unix:shadow_test>
        <ind:textfilecontent54_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" check="all" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" check_existence="any_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" check="all" comment="SYS_UID_MIN not defined in /etc/login.defs" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" check="all" comment="SYS_UID_MAX not defined in /etc/login.defs" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" check="all" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" check_existence="any_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" check="all" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" check_existence="any_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_sys_uid_min:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" check="all" comment="serial ports /etc/securetty" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" check="all" comment="virtual consoles /etc/securetty" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" check="all" comment="check existence of use_uid option for pam_wheel.so in /etc/pam.d/su" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_use_pam_wheel_for_su:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_use_pam_wheel_group_for_su:tst:1" version="1" check="all" comment="check /etc/pam.d/su for correct setting" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_use_pam_wheel_group_for_su:obj:1"/>
          <ind:state state_ref="oval:ssg-state_use_pam_wheel_group_for_su:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" check="all" comment="Check value of CREATE_HOME in /etc/login.defs" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" check="all" comment="check FAIL_DELAY in /etc/login.defs" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_logon_fail_delay:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_logon_fail_delay:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_maxlogins:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_tmp_inst:tst:1" version="1" check="all" comment="Check that /tmp/tmp-inst doesn't exist or it exists and has mode 000" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_tmp_inst:obj:1"/>
          <unix:state state_ref="oval:ssg-state_tmp_inst:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_tmp_in_namespace_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" check="all" comment="Check that /var/tmp/tmp-inst doesn't exist or it exists and has mode 000" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_var_tmp_tmp_inst:obj:1"/>
          <unix:state state_ref="oval:ssg-state_var_tmp_tmp_inst:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_profile_tmout:tst:1" version="2" check="all" comment="TMOUT in /etc/profile" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" check="all" comment="TMOUT in /etc/profile.d/*.sh" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_accounts_tmout_defined:tst:1" version="1" check="all" comment="Check that at least one TMOUT is defined" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_tmout_defined:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_tmout_defined:ste:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_accounts_user_dot_group_ownership:tst:1" version="1" check="all" comment="All user initialization files are group-owned by a local interactive user" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_user_dot_group_ownership_init_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_user_dot_group_ownership_gids:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_user_dot_no_world_writable_programs:tst:1" version="1" check="all" comment="Init files do not execute world-writable programs" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_user_dot_no_world_writable_programs_init_files:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_accounts_user_dot_user_ownership:tst:1" version="1" check="all" comment="All user initialization files are owned by a local interactive user" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_user_dot_user_ownership_init_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_user_dot_user_ownership_uids:ste:1"/>
        </unix:file_test>
        <unix:password_test id="oval:ssg-test_accounts_user_interactive_home_directory_defined:tst:1" version="1" check="all" comment="All Interactive Users Have A Home Directory Defined" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_user_interactive_home_directory_defined_objects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_user_interactive_home_directory_defined:ste:1"/>
        </unix:password_test>
        <ind:variable_test id="oval:ssg-test_accounts_user_interactive_home_directory_exists:tst:1" version="1" check="all" comment="Check the existence of interactive users." state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_count_fs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_user_interactive_home_directory_exists_dirs_count_pw:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_accounts_user_interactive_home_directory_exists_users:tst:1" version="1" check="all" comment="Check the existence of interactive users." check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_count_pw:obj:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_accounts_users_home_files_groupownership:tst:1" version="1" check="all" comment="All home directories files are group-owned by a local interactive user" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_users_home_files_groupownership_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_users_home_files_groupownership_gids:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_accounts_users_home_files_ownership:tst:1" version="1" check="all" comment="All home directories files are owned by a local interactive user" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_users_home_files_ownership_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_users_home_files_ownership_uids:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_accounts_users_home_files_permissions_files:tst:1" version="1" check="all" comment="All files into home directories have proper permissions" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_users_home_files_permissions_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_users_home_files_permissions_dirs:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_accounts_users_home_files_permissions_dirs:tst:1" version="1" check="all" comment="All directories into home directories have proper permissions" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_users_home_files_permissions_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_users_home_files_permissions_dirs:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownership_home_directories:tst:1" version="1" check="all" comment="All home directories are group-owned by a local interactive group" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownership_home_directories_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupownership_home_directories_gids:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permission_user_init_files:tst:1" version="1" check="all" comment="Init files have mode 0740 or less permissive" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permission_user_init_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permission_user_init_files:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_home_directories:tst:1" version="1" check="all" comment="All home directories have proper permissions" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_home_directories_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_home_directories_dirs:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" check="all" comment="All home directories have proper permissions" check_existence="any_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_home_dirs_dirs:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" check="all" comment="Check if there aren't directories in root's path having write permission set for group or other" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
        </unix:file_test>
        <ind:environmentvariable58_test id="oval:ssg-test_env_var_begins:tst:1" version="1" check="none satisfy" comment="environment variable PATH starts with : or ." state_operator="AND">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test id="oval:ssg-test_env_var_ends:tst:1" version="1" check="none satisfy" comment="environment variable PATH ends with : or ." state_operator="AND">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test id="oval:ssg-test_env_var_begins_slash:tst:1" version="1" check="none satisfy" comment="environment variable PATH starts with an absolute path /" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" check="none satisfy" comment="environment variable PATH contains relative paths" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_bashrc:tst:1" version="1" check="all" comment="Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_bashrc:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_bashrc:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1" version="1" check="all" comment="Test the retrieved /etc/csh.cshrc umask value(s) match the var_accounts_user_umask requirement" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_csh_cshrc:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_csh_cshrc:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="umask value(s) from profile configuration files match the requirement" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_umask_interactive_users:tst:1" version="1" check="all" comment="Umask must not be defined in user initialization files" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_umask_interactive_users:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_bootloader_superuser_differ_from_other_users:tst:1" version="1" check="all" comment="superuser           is defined in /boot/grub2/grub.cfg. Superuser is not           equal to other system account nor root, admin, administrator" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_bootloader_unique_superuser:obj:1"/>
          <ind:state state_ref="oval:ssg-state_bootloader_superuser_differ_from_other_users:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" check="all" comment="make sure a password is defined in /boot/grub2/user.cfg" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_password_usercfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" check="all" comment="make sure a password is defined in /boot/grub2/user.cfg" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_uefi_password_usercfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_default_mmap_min_addr_x86_64:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEFAULT_MMAP_MIN_ADDR=65536" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_default_mmap_min_addr_x86_64:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_default_mmap_min_addr_aarch64:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEFAULT_MMAP_MIN_ADDR=32768" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_default_mmap_min_addr_aarch64:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_kernel_config_default_mmap_min_addr_all_kernels:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_default_mmap_min_addr_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_default_mmap_min_addr:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" check="all" comment="proc_sys_kernel is for aarch64 architecture" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_x86_64:tst:1" version="1" check="all" comment="proc_sys_kernel is for x86_64 architecture" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_x86_64:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_x86_64:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" check="all" comment="cron is configured in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_rainer:tst:1" version="1" check="all" comment="cron is configured in /etc/rsyslog.conf using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" check="all" comment="cron is configured in /etc/rsyslog.d" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_dir_rainer:tst:1" version="1" check="all" comment="cron is configured in /etc/rsyslog.d using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_logging_all_facilities:tst:1" version="1" check="all" comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_logging_all_facilities:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_dir_logging_all_facilities:tst:1" version="1" check="all" comment="rsyslog is configured in /etc/rsyslog.d to log to all facilities" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir_logging_all_facilities:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" check="all" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_rainer:tst:1" version="1" check="all" comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" check="all" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir_rainer:tst:1" version="1" check="all" comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" check="all" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_rainer:tst:1" version="1" check="all" comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" check="all" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir_rainer:tst:1" version="1" check="all" comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" check="all" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_rainer:tst:1" version="1" check="all" comment="Check if DefaultNetstreamDriver is set to gtls in /etc/rsyslog.conf using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" check="all" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir_rainer:tst:1" version="1" check="all" comment="Check if DefaultNetstreamDriver is set to gtls in files in /etc/rsyslog.d using RainerScript" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir_rainer:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" check="all" comment="remote method auth monitoring configured in rsyslog'" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" check="all" comment="remote method authpriv monitoring configured in rsyslog'" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" check="all" comment="remote method daemon monitoring configured in rsyslog'" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_daemon:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" check="all" comment="Tests the presence of daily setting in /etc/logrotate.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" check="all" comment="Test if there is no weekly/monthly/yearly keyword" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" check="all" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_logrotate_enabled_systemd_target:tst:1" version="1" check="all" comment="look for logrotate.timer in multi-user.target.wants and timers.target.wants" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_logrotate_enabled_systemd_target:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_nolisten_legacy:tst:1" version="1" check="all" comment="rsyslog configuration files don't contain $InputTCPServerRun | $UDPServerRun |             $InputRELPServerRun | $ModLoad imtcp | $ModLoad imudp | $ModLoad imrelp" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_rsyslog_nolisten_legacy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_nolisten_rainerscript:tst:1" version="1" check="all" comment="rsyslog configuration files don't use imtcp or imudp modules" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_rsyslog_nolisten_rainerscript:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" check="all" comment="Ensures system configured to export logs to remote host" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" check="all" comment="Ensures system configured to export logs to remote host" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" check="all" comment="tests the omfwd action configuration" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_remote_tls:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rsyslog_remote_tls:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" check="all" comment="tests the DefaultNetstreamDriverCAFile configuration" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_network_configure_name_resolution:tst:1" version="1" check="all" comment="check if more than one nameserver in /etc/resolv.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_network_configure_name_resolution:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_host_line_dns_parameter_nsswitch:tst:1" version="1" check="all" comment="check if dns is set in host line in  /etc/nsswitch.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_host_line_dns_parameter_nsswitch:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_empty_resolv:tst:1" version="1" check="all" comment="check if /etc/resolv.conf is empty" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_file_empty_resolv:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_empty_resolv:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" check="all" comment="polkit is properly configured to prevent non-privilged users from changing networking settings" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_network_nmcli_permissions:obj:1"/>
          <ind:state state_ref="oval:ssg-state_network_nmcli_permissions:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:interface_test id="oval:ssg-test_promisc_interfaces:tst:1" version="1" check="all" comment="check all network interfaces for PROMISC flag" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_promisc:ste:1"/>
        </unix:interface_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_loopback_restricted_source_usr:tst:1" version="1" check="all" comment="default trusted zone has rich-rule to restrict loopback source" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_loopback_restricted_source_usr:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_loopback_restricted_destination_usr:tst:1" version="1" check="all" comment="default trusted zone has rich-rule to restrict loopback destination" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_loopback_restricted_destination_usr:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_loopback_restricted_policy_usr:tst:1" version="1" check="all" comment="default trusted zone has rich-rule to restrict loopback traffic" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_loopback_restricted_policy_usr:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_loopback_restricted_source_etc:tst:1" version="1" check="all" comment="custom trusted zone has rich-rule to restrict loopback source" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_loopback_restricted_source_etc:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_loopback_restricted_destination_etc:tst:1" version="1" check="all" comment="custom trusted zone has rich-rule to restrict loopback destination" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_loopback_restricted_destination_etc:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_loopback_restricted_policy_etc:tst:1" version="1" check="all" comment="custom trusted zone has rich-rule to restrict loopback traffic" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_loopback_restricted_policy_etc:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_lo_interface_trusted_usr:tst:1" version="1" check="all" comment="lo interface is assigned to the trusted zone by default" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_lo_interface_trusted_usr:obj:1"/>
        </ind:xmlfilecontent_test>
        <ind:xmlfilecontent_test id="oval:ssg-test_firewalld_lo_interface_trusted_etc:tst:1" version="1" check="all" comment="lo interface is assigned to the custom trusted zone in /etc/firewalld/zones" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_firewalld_lo_interface_trusted_etc:obj:1"/>
        </ind:xmlfilecontent_test>
        <unix:file_test id="oval:ssg-test_firewalld_trusted_zone_not_overridden:tst:1" version="1" check="all" comment="there is no equivalent file for trusted zone defined by the administrator" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_firewalld_customized_trusted_zone_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" comment="ipv6 disabled any modprobe conf file" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:interface_test id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" check="all" comment="check if UP flag is present on wifi interfaces" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_active_wifi_interfaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_wifi_up:ste:1"/>
        </unix:interface_test>
        <ind:textfilecontent54_test id="oval:ssg-test_networkmanager_dns_mode:tst:1" version="1" check="all" comment="tests the value of dns setting in the /etc/NetworkManager/NetworkManager.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_networkmanager_dns_mode:obj:1"/>
          <ind:state state_ref="oval:ssg-state_networkmanager_dns_mode:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_networkmanager_dns_mode_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/NetworkManager/NetworkManager.conf exists for networkmanager_dns_mode" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_networkmanager_dns_mode_config_file:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" check="all" comment="check for local directories that are world writable and have uid greater than 0" state_operator="AND">
          <unix:object object_ref="oval:ssg-all_local_directories_uid_zero:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="2" check="all" comment="Check the existence of world-writable directories without sticky bits" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_dir_perms_world_writable_sticky_bits:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_group_ownership_system_commands_dirs:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_commands_dirs_group_ownership:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_system_commands_directory_bin:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_system_commands_directory_bin_ownership:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_system_commands_directory_sbin:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_system_commands_directory_sbin_ownership:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_system_commands_directory_usr_bin:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_system_commands_directory_usr_bin_ownership:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_system_commands_directory_usr_sbin:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_system_commands_directory_usr_sbin_ownership:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_system_commands_directory_usr_local_bin:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_system_commands_directory_usr_local_bin_ownership:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_system_commands_directory_usr_local_sbin:tst:1" version="1" check="all" comment="system commands directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_ownership_system_commands_directory_usr_local_sbin_ownership:obj:1"/>
        </unix:file_test>
        <ind:variable_test id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" check="all" comment="Check the existence of sgid files not included in rpm packages." check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_file_permissions_unauthorized_sgid_no_rpm_files:obj:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" check="all" comment="Check the existence of suid files not included in rpm packages." check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_file_permissions_unauthorized_suid_no_rpm_files:obj:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" check="all" comment="Check the existence of world-writable files" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_file_permissions_ungroupowned_nsswitch_uses_altfiles:tst:1" version="1" check="all" comment="Test if /etc/nssswitch.conf contains 'altfiles' in 'group' key" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_file_permissions_ungroupowned_nsswitch_uses_altfiles:obj:1"/>
          <ind:state state_ref="oval:ssg-state_file_permissions_ungroupowned_nsswitch_uses_altfiles:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" check="all" comment="there are no files with group owner different than local groups" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_ungroupowned_with_usrlib:tst:1" version="1" check="all" comment="there are no files with group owner different than local groups" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_ungroupowned_with_usrlib:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_no_files_unowned_by_user:tst:1" version="2" check="all" comment="there are no files without a known owner" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_no_files_unowned_by_user:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" check="all" comment="system commands are owned by root or a system account" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_groupownership_system_commands_dirs:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_binary_directories:tst:1" version="1" check="all" comment="binary directories uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_ownership_binary_files:tst:1" version="1" check="all" comment="binary files uid root" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_perms_binary_files:tst:1" version="1" check="all" comment="binary files go-w" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
        </unix:file_test>
        <linux:partition_test id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" check="all" comment="nodev on local filesystems" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
          <linux:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_nonroot_local_partitions_in_fstab:tst:1" version="1" check="all" comment="nodev on local filesystems in /etc/fstab" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_non_root_partitions_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_non_root_partitions_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.core_pattern set to an empty string" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_core_pattern_empty_string_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_static:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern_empty_string:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern_empty_string:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_static_etc_sysctld:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern_empty_string:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_static_run_sysctld:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /run/sysctl.d/*.conf" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern_empty_string:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_sysctl_kernel_core_pattern_empty_string_defined_in_one_file:tst:1" version="1" check="all" comment="Check that only one file contains kernel_core_pattern" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_defined_in_one_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sysctl_kernel_core_pattern_empty_string_defined_in_one_file:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" check="all" comment="tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_backtraces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_backtraces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coredump_disable_backtraces_config_dir:tst:1" version="1" check="all" comment="tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf.d file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_backtraces_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_backtraces_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coredump_disable_storage:tst:1" version="1" check="all" comment="tests the value of Storage setting in the /etc/systemd/coredump.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_storage:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_storage:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coredump_disable_storage_config_dir:tst:1" version="1" check="all" comment="tests the value of Storage setting in the /etc/systemd/coredump.conf.d file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_storage_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_storage_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_core_dumps_limits_d:obj:1"/>
          <ind:state state_ref="oval:ssg-state_core_dumps_limits_d:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" check="all" comment="Tests for existance of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_core_dumps_limits_d_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nx_disabled_grub:tst:1" version="1" check="all" comment="NX is disabled" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nx_disabled_grub:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_NX_cpu_support:tst:1" version="1" check="all" comment="CPUs support for NX bit" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_NX_cpu_support:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" check="all" comment="NX is not disabled in the kernel command line" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_noexec_cmd_line:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_selinux_default_grub:tst:1" version="1" check="all" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_selinux_default_grub:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" check="all" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_selinux_grub2_cfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_selinux_grub_dir:tst:1" version="1" check="all" comment="check value selinux|enforcing=0 in /etc/grub.d fail if found" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_selinux_grub_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:selinuxsecuritycontext_test id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" check="none satisfy" comment="device_t in /dev" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_selinux_dev_device_t:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_dev_device_t:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <linux:selinuxsecuritycontext_test id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" check="none satisfy" comment="unlabeled_t in /dev" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_selinux_dev_unlabeled_t:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_dev_unlabeled_t:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <linux:selinuxsecuritycontext_test id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" check="none satisfy" comment="none satisfy unconfined_service_t in /proc" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <ind:textfilecontent54_test id="oval:ssg-test_selinux_not_disabled:tst:1" version="1" check="all" comment="SELinux is not disabled in /etc/selinux/config" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_selinux_not_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_selinux_not_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_selinux_policy:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_selinux_config:tst:1" version="1" check="all" comment="/selinux/enforce is 1" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-test_package_kernel_x64:tst:1" version="1" check="all" comment="Package kernel arch is x64" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_package_kernel:obj:1"/>
          <linux:state state_ref="oval:ssg-state_installed_arch_of_kernel_package:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" check="all" comment="Check for CPU flag lm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_cpuinfo_64_bit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_cpuinfo_64_bit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" check="all" comment="Check if kernel nvr arch is 64-bit" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" check="all" comment="Check if the local dconf DB is up-to-date with keyfiles in the local tree." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_local_db_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_local_db_is_up_to_date:ste:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" check="all" comment="no keyfiles applicable to the local database" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_dconf_local_config:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dconf_user_profile:tst:1" version="1" check="all" comment="dconf user profile exists" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dconf_user_profile:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_restart_buttons:tst:1" version="1" check="all" comment="GUI restart and shutdown buttons are disabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_restart_buttons:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" check="all" comment="GUI restart and shutdown buttons cannot be enabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_user_list:tst:1" version="1" check="all" comment="GUI user list is disabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_user_list:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" check="all" comment="GUI user list cannot be enabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_disable_user_list:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_automatic_login:tst:1" version="1" check="all" comment="Disable GDM Automatic Login" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" check="all" comment="tests the value of Enable setting in the /etc/gdm/custom.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" check="all" comment="Disable automount in GNOME3" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" check="all" comment="Prevent user from changing automount setting" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" check="all" comment="Disable automount-open in GNOME" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" check="all" comment="Prevent user from changing automount-open setting" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" check="all" comment="Disable autorun in GNOME" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" check="all" comment="Prevent user from changing autorun setting" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_autorun:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" check="all" comment="configure remote access credentials" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_configure_remote_access_creds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" check="all" comment="prevent user from disabling remote access credential requirements" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_creds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" check="all" comment="configure remote access encryption" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_configure_remote_access_encryption:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" check="all" comment="prevent user from disabling remote access encryption" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" check="all" comment="idle delay is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" check="all" comment="user cannot change idle_activation_enabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" check="all" comment="screensaver idle delay is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" check="all" comment="screensaver idle delay setting is correct" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_screensaver_idle_delay_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" check="all" comment="screensaver lock is set correctly" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" check="all" comment="screensaver lock delay setting is correct" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_screensaver_lock_delay_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" check="all" comment="screensaver lock is enabled" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" check="all" comment="screensaver lock cannot be changed by user" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" check="all" comment="screensaver mode is blank" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_screensaver_mode_blank:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" check="all" comment="blank screensaver cannot be changed by user" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" check="all" comment="screensaver lock delay cannot be changed by user" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_user_change_lock_delay_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" check="all" comment="user cannot change screensaver idle delay" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_user_change_idle_delay_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" check="all" comment="Disable Ctrl-Alt-Del" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" check="all" comment="Prevent enabling of ctrl-alt-del keys" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" check="all" comment="Check that the configuration includes the policy config file." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_bind_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" check="all" comment="Check if update-crypto-policies has been run" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy:tst:1" version="1" check="all" comment="check for crypto policy correctly configured in /etc/crypto-policies/config" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" check="all" comment="check for crypto policy correctly configured in /etc/crypto-policies/state/current" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_crypto_policy_current:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_crypto_policy_current:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" check="all" comment="Check if /etc/crypto-policies/back-ends/nss.config exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_crypto_policy_nss_config:obj:1"/>
        </unix:file_test>
        <ind:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" check="all" comment="Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" check="all" comment="Check if kerberos configuration symlink links to the crypto-policy backend file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" check="all" comment="Check that the libreswan configuration includes the crypto policy config file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_libreswan_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" check="all" comment="Check that the configuration mandates usage of system-wide crypto policies." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_openssl_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" check="all" comment="Check that the SSH configuration mandates usage of system-wide crypto policies." check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_configure_ssh_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" check="all" comment="tests the absence of Match setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" check="all" comment="tests the absence of RekeyLimit setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" check="all" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" check="all" comment="tests the absence of Ciphers setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" check="all" comment="tests the absence of PubkeyAcceptedKeyTypes setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" check="all" comment="tests the absence of MACs setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" check="all" comment="tests the absence of KexAlgorithms setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of Ciphers setting in the /etc/crypto-policies/back-ends/openssh.config file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_sshd_ciphers_opensshserver_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of Ciphers setting in the /etc/crypto-policies/back-ends/opensshserver.config file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_ciphers_opensshserver_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_ciphers_opensshserver_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of MACs setting in the /etc/crypto-policies/back-ends/openssh.config file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_harden_sshd_macs_opensshserver_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of MACs setting in the /etc/crypto-policies/back-ends/opensshserver.config file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_macs_opensshserver_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_macs_opensshserver_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:process58_test id="oval:ssg-test_agent_mfetpd_running:tst:1" version="1" check="all" comment="is mfetpd running" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_agent_mfetpd_running:obj:1"/>
        </unix:process58_test>
        <ind:textfilecontent54_test id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" check="all" comment="add_dracutmodules contains fips" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_enable_dracut_fips_module:obj:1"/>
          <ind:state state_ref="oval:ssg-state_enable_dracut_fips_module:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_fips_1_argument_in_boot_loader_entries_conf:tst:1" version="1" check="all" comment="check if kernel option fips=1 is present in options in /boot/loader/entries/.*.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_fips_1_argument_in_boot_loader_entries_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_fips_1_argument_in_captured_group:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" check="at least one" comment="test if var_system_crypto_policy selection is set to FIPS" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_system_crypto_policy_value:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_system_crypto_policy_value:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_crypto_fips_enabled:tst:1" version="1" check="all" comment="kernel runtime parameter crypto.fips_enabled set to 1" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_proc_sys_crypto_fips_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_etc_system_fips:tst:1" version="1" check="all" comment="/etc/system-fips exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_etc_system_fips:obj:1"/>
        </unix:file_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" check="all" comment="kernel runtime parameter crypto.fips_enabled set to 1" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1"/>
        </unix:sysctl_test>
        <unix:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" check="all" comment="Testing existence of operational aide database file" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" check="all" comment="auditctl is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_auditd:tst:1" version="1" check="all" comment="auditd is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_auditd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" check="all" comment="ausearch is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_ausearch:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_aureport:tst:1" version="1" check="all" comment="aureport is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_aureport:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_autrace:tst:1" version="1" check="all" comment="autrace is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_autrace:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_rsyslogd:tst:1" version="1" check="all" comment="rsyslogd is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_rsyslogd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" check="all" comment="augenrules is checked in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" check="all" comment="run aide with cron" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_crond_checking:tst:1" version="1" check="all" comment="run aide with cron" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" check="all" comment="run aide with cron" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" check="all" comment="run aide with cron.(daily|weekly)" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_scan_notification:tst:1" version="1" check="all" comment="notify personnel when aide completes" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_aide_scan_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_var_cron_notification:tst:1" version="1" check="all" comment="notify personnel when aide completes" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_var_cron_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_crontabs_notification:tst:1" version="1" check="all" comment="notify personnel when aide completes in cron.(daily|weekly|monthly)" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_crontabs_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_non_fips_hashes:tst:1" version="1" check="all" comment="Verify non-FIPS hashes are not configured in /etc/aide.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_non_fips_hashes:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_use_fips_hashes:tst:1" version="1" check="all" comment="Verify FIPS hashes are configured in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_use_fips_hashes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_use_fips_hashes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_acls:tst:1" version="1" check="all" comment="acl is set in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_acls:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_verify_acls:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_ext_attributes:tst:1" version="1" check="all" comment="xattrs is set in /etc/aide.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_aide_verify_ext_attributes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_verify_ext_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpmverifyfile_test id="oval:ssg-test_rpm_verify_hashes:tst:1" version="2" check="all" comment="verify file md5 hashes" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_rpm_verify_hashes_fail_md5_hash:obj:1"/>
        </linux:rpmverifyfile_test>
        <linux:rpmverifyfile_test id="oval:ssg-test_rpm_verify_ownership_verify_all_rpms_ownership:tst:1" version="1" check="all" comment="Ownership of all files matches local rpm database" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_rpm_verify_ownership_files_fail_ownership:obj:1"/>
        </linux:rpmverifyfile_test>
        <linux:rpmverifyfile_test id="oval:ssg-test_rpm_verify_permissions:tst:1" version="1" check="all" comment="mode of all files matches local rpm database" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_rpm_verify_permissions_files_fail_mode:obj:1"/>
        </linux:rpmverifyfile_test>
        <unix:file_test id="oval:ssg-test_sudo_owned_by_dedicated_group:tst:1" version="1" check="all" comment="Check /usr/bin/sudo is owned by group defined in var_sudo_dedicated_group " check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_sudo_file:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sudo_file_gid_is_dedicated_group_gid:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dedicated_group_exists:tst:1" version="1" check="all" comment="Check if dedicated group is listed in /etc/group" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-sudo_dedicated_group_gid:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" check="all" comment="!authenticate does not exist in /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" check="all" comment="!authenticate does not exist in /etc/sudoers.d" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" check="all" comment="NOPASSWD does not exist /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" check="all" comment="NOPASSWD does not exist in /etc/sudoers.d" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudo_timestamp_timeout:tst:1" version="1" check="all" comment="check correct configuration in /etc/sudoers" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sudo_timestamp_timeout:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudo_timestamp_timeout_no_signs:tst:1" version="1" check="all" comment="check correct configuration in /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sudo_timestamp_timeout_no_signs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_not_all_users_can_sudo_to_users:tst:1" version="1" check="all" comment="Make sure that sudoers has restrictions on which users can run sudo" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sudoers_cfg_spec_all_users:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_not_all_users_can_sudo_to_group:tst:1" version="1" check="all" comment="Make sure that sudoers has restrictions on which users can run sudo" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sudoers_cfg_spec_all_group:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" check="all" comment="NOPASSWD only exists for vdsm user in /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" check="all" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" check="all" comment="Make sure that no command in user spec is without any argument" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sudoers_explicit_command_args:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" check="all" comment="Make sure that no command in user spec contains negation" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sudoers_no_command_negation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" check="all" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-root_or_ALL_in_runas_spec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_user_spec_rules:tst:1" version="1" check="all" comment="make sure that all user specs in sudoers feature a runas spec" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_no_runas_spec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_targetpw_not_defined:tst:1" version="1" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_sudoers_targetpw_not_defined:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_rootpw_not_defined:tst:1" version="1" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_sudoers_rootpw_not_defined:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sudoers_runaspw_not_defined:tst:1" version="1" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_test_sudoers_runaspw_not_defined:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_yum_clean_components_post_updating:tst:1" version="1" check="all" comment="check value of clean_requirements_on_remove in /etc/yum.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_yum_clean_components_post_updating:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" check="all" comment="tests the value of apply_updates setting in the /etc/dnf/automatic.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dnf-automatic_apply_updates:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" check="all" comment="tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dnf-automatic_security_updates_only:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" check="all" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" check="all" comment="check value of gpgcheck in /etc/yum.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" check="all" comment="check value of localpkg_gpgcheck in /etc/yum.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" check="all" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-test_oracle_package_gpgkey-8d8b756f-629e59ec_installed:tst:1" version="1" check="only one" comment="Oracle release key package is installed" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_oracle_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_oracle_package_gpg-pubkey-8d8b756f-629e59ec:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_oracle_package_gpgkey-8b4efbe6-629ec292_installed:tst:1" version="1" check="only one" comment="Oracle auxiliary key package is installed" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_oracle_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_oracle_package_gpg-pubkey-8b4efbe6-629ec292:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dcredit_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_dcredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dictcheck_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dictcheck_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_dictcheck:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_difok_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_difok_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_difok:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_difok:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_lcredit_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_lcredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxclassrepeat_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxclassrepeat:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxclassrepeat_zero_comparison:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxrepeat_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxrepeat:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minclass_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_minclass:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minlen_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_minlen:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ocredit_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_ocredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ucredit_not_overwritten:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth doens't override pwquality.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit_not_overwritten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_ucredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1" version="2" check="all" comment="no more that one pam_unix.so is expected in auth section of system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1" version="2" check="all" comment="One and only one occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1" version="2" check="all" comment="no more that one pam_unix.so is expected in auth section of password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1" version="2" check="all" comment="One and only one occurrence is expected in auth section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1" version="2" check="all" comment="One and only one occurrence is expected in system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1" version="2" check="all" comment="One and only one occurrence is expected in password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1" version="2" check="all" comment="Check the absence of deny parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1" version="2" check="all" comment="Check the expected deny value in system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1" version="2" check="all" comment="Check the absence of deny parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1" version="2" check="all" comment="Check the expected deny value in password-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected deny value in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of deny parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_unix_auth:tst:1" version="2" check="all" comment="no more that one pam_unix.so is expected in auth section of system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_auth:tst:1" version="2" check="all" comment="One and only one occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_unix_auth:tst:1" version="2" check="all" comment="no more that one pam_unix.so is expected in auth section of password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_auth:tst:1" version="2" check="all" comment="One and only one occurrence is expected in auth section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_account:tst:1" version="2" check="all" comment="One and only one occurrence is expected in system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_account:tst:1" version="2" check="all" comment="One and only one occurrence is expected in password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_system:tst:1" version="2" check="all" comment="Check the absence of fail_interval parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:tst:1" version="2" check="all" comment="Check the expected fail_interval value in system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_password:tst:1" version="2" check="all" comment="Check the absence of fail_interval parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:tst:1" version="2" check="all" comment="Check the expected fail_interval value in password-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected fail_interval value in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of fail_interval parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1" version="2" check="all" comment="no more that one pam_unix.so is expected in auth section of system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1" version="2" check="all" comment="One and only one occurrence is expected in auth section of system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1" version="2" check="all" comment="no more that one pam_unix.so is expected in auth section of password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1" version="2" check="all" comment="One and only one occurrence is expected in auth section of password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1" version="2" check="all" comment="One and only one occurrence is expected in system-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1" version="2" check="all" comment="One and only one occurrence is expected in password-auth" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1" version="2" check="all" comment="Check the absence of unlock_time parameter in system-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1" version="2" check="all" comment="Check the expected unlock_time value in system-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1" version="2" check="all" comment="Check the absence of unlock_time parameter in password-auth" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1" version="2" check="all" comment="Check the expected unlock_time value in password-auth" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1" version="1" check="all" comment="Check the expected unlock_time value in /etc/security/faillock.conf" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1" version="1" check="all" comment="Check the absence of unlock_time parameter in /etc/security/faillock.conf" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_access_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_access_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_access_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_access_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-3-access-success.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_access_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_access_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_basic_configuration_test_whole_file_contents_tc_audit_rules_d_10_base_config_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/10-base-config.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_basic_configuration_object_whole_file_contents_tc_audit_rules_d_10_base_config_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_basic_configuration_state_whole_file_contents_tc_audit_rules_d_10_base_config_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_create_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_create_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_create_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_create_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-1-create-success.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_create_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_create_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_delete_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_delete_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_delete_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_delete_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_delete_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_delete_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_immutable_login_uids_test_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/11-loginuid.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_immutable_login_uids_object_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_immutable_login_uids_state_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_modify_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_modify_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_modify_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_modify_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_modify_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_modify_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_module_load_test_whole_file_contents_tc_audit_rules_d_43_module_load_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/43-module-load.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_module_load_object_whole_file_contents_tc_audit_rules_d_43_module_load_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_module_load_state_whole_file_contents_tc_audit_rules_d_43_module_load_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_ospp_general_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_ospp_general_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_ospp_general_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_owner_change_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_owner_change_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_owner_change_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_owner_change_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_owner_change_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_owner_change_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_perm_change_failed_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_perm_change_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_perm_change_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-audit_perm_change_success_test_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:tst:1" version="1" check="all" comment="Tests if contents of /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules is exactly what is defined in rule description" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-audit_perm_change_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:obj:1"/>
          <ind:state state_ref="oval:ssg-audit_perm_change_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_init_augenrules:tst:1" version="1" check="all" comment="audit augenrules init" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_init_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_init_auditctl:tst:1" version="1" check="all" comment="audit auditctl init" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_init_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_poweroff_augenrules:tst:1" version="1" check="all" comment="audit augenrules poweroff" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_poweroff_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_poweroff_auditctl:tst:1" version="1" check="all" comment="audit auditctl poweroff" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_poweroff_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_reboot_augenrules:tst:1" version="1" check="all" comment="audit augenrules reboot" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_reboot_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_reboot_auditctl:tst:1" version="1" check="all" comment="audit auditctl reboot" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_reboot_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_shutdown_augenrules:tst:1" version="1" check="all" comment="audit augenrules shutdown" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_shutdown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_privileged_commands_shutdown_auditctl:tst:1" version="1" check="all" comment="audit auditctl shutdown" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_privileged_commands_shutdown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit chmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit chmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit chmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit chmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit chown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit chown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit chown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit chown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchmod" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchmodat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchmodat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchmodat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchmodat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchownat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchownat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchownat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchownat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lchown" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lremovexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lsetxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit removexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit removexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit removexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit removexattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit setxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit setxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit setxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit setxattr" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit umount2" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit umount2" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit umount2" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit umount2" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chacl_augenrules:tst:1" version="1" check="all" comment="audit augenrules chacl" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chacl_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chacl_auditctl:tst:1" version="1" check="all" comment="audit auditctl chacl" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chacl_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" check="all" comment="audit augenrules chcon" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" check="all" comment="audit auditctl chcon" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" check="all" comment="audit augenrules restorecon" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" check="all" comment="audit auditctl restorecon" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" check="all" comment="audit augenrules semanage" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" check="all" comment="audit auditctl semanage" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setfacl_augenrules:tst:1" version="1" check="all" comment="audit augenrules setfacl" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setfacl_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setfacl_auditctl:tst:1" version="1" check="all" comment="audit auditctl setfacl" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setfacl_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setfiles_augenrules:tst:1" version="1" check="all" comment="audit augenrules setfiles" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setfiles_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setfiles_auditctl:tst:1" version="1" check="all" comment="audit auditctl setfiles" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setfiles_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" check="all" comment="audit augenrules setsebool" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" check="all" comment="audit auditctl setsebool" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" check="all" comment="audit augenrules seunshare" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" check="all" comment="audit auditctl seunshare" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit rename" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit rename" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit rename" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit rename" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit renameat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit renameat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit renameat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit renameat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit rmdir" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit rmdir" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit rmdir" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit rmdir" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit unlink" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit unlink" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit unlink" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit unlink" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit unlinkat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit unlinkat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit unlinkat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit unlinkat" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_var_accounts_passwords_pam_faillock_dir_augenrules:tst:1" version="1" check="all" comment="audit augenrules var_accounts_passwords_pam_faillock_dir" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_var_accounts_passwords_pam_faillock_dir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_var_accounts_passwords_pam_faillock_dir_auditctl:tst:1" version="1" check="all" comment="audit auditctl var_accounts_passwords_pam_faillock_dir" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_var_accounts_passwords_pam_faillock_dir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" check="all" comment="audit augenrules lastlog" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_lastlog_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" check="all" comment="audit auditctl lastlog" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_lastlog_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" check="all" comment="audit augenrules tallylog" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_tallylog_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" check="all" comment="audit auditctl tallylog" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_tallylog_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit mount" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit mount" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit mount" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit mount" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules at" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl at" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" check="all" comment="audit augenrules chage" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" check="all" comment="audit auditctl chage" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" check="all" comment="audit augenrules chsh" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" check="all" comment="audit auditctl chsh" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" check="all" comment="audit augenrules crontab" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" check="all" comment="audit auditctl crontab" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" check="all" comment="audit augenrules gpasswd" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" check="all" comment="audit auditctl gpasswd" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_kmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules kmod" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_kmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_kmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl kmod" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_kmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules mount" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl mount" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" check="all" comment="audit augenrules newgrp" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" check="all" comment="audit auditctl newgrp" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_pam_timestamp_check_augenrules:tst:1" version="1" check="all" comment="audit augenrules pam_timestamp_check" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pam_timestamp_check_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_pam_timestamp_check_auditctl:tst:1" version="1" check="all" comment="audit auditctl pam_timestamp_check" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pam_timestamp_check_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" check="all" comment="audit augenrules passwd" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" check="all" comment="audit auditctl passwd" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_postdrop_augenrules:tst:1" version="1" check="all" comment="audit augenrules postdrop" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_postdrop_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_postdrop_auditctl:tst:1" version="1" check="all" comment="audit auditctl postdrop" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_postdrop_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_postqueue_augenrules:tst:1" version="1" check="all" comment="audit augenrules postqueue" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_postqueue_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_postqueue_auditctl:tst:1" version="1" check="all" comment="audit auditctl postqueue" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_postqueue_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_agent_augenrules:tst:1" version="1" check="all" comment="audit augenrules ssh_agent" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_agent_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_agent_auditctl:tst:1" version="1" check="all" comment="audit auditctl ssh_agent" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_agent_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" check="all" comment="audit augenrules ssh_keysign" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" check="all" comment="audit auditctl ssh_keysign" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" check="all" comment="audit augenrules su" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" check="all" comment="audit auditctl su" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudo" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudo" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoedit" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoedit" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" check="all" comment="audit augenrules umount" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" check="all" comment="audit auditctl umount" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" check="all" comment="audit augenrules unix_chkpwd" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" check="all" comment="audit auditctl unix_chkpwd" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_update_augenrules:tst:1" version="1" check="all" comment="audit augenrules unix_update" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_update_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_update_auditctl:tst:1" version="1" check="all" comment="audit auditctl unix_update" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_update_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" check="all" comment="audit augenrules userhelper" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" check="all" comment="audit auditctl userhelper" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usermod_augenrules:tst:1" version="1" check="all" comment="audit augenrules usermod" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usermod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usermod_auditctl:tst:1" version="1" check="all" comment="audit auditctl usermod" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usermod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" check="all" comment="audit augenrules usernetctl" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" check="all" comment="audit auditctl usernetctl" check_existence="only_one_exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" check="all" comment="audit augenrules group" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" check="all" comment="audit group" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" check="all" comment="audit augenrules gshadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" check="all" comment="audit gshadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" check="all" comment="audit augenrules opasswd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" check="all" comment="audit opasswd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" check="all" comment="audit augenrules passwd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" check="all" comment="audit passwd" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" check="all" comment="audit augenrules shadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" check="all" comment="audit shadow" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_sudo_log_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudo_log" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_sudo_log_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_arle_sudo_log_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudo_log" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_arle_sudo_log_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_freq:tst:1" version="1" check="all" comment="tests the value of freq setting in the /etc/audit/auditd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_freq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_freq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_local_events:tst:1" version="1" check="all" comment="tests the value of local_events setting in the /etc/audit/auditd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_local_events:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_local_events:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_log_format:tst:1" version="1" check="all" comment="tests the value of log_format setting in the /etc/audit/auditd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_log_format:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_log_format:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_write_logs:tst:1" version="1" check="all" comment="tests the value of write_logs setting in the /etc/audit/auditd.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_write_logs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_write_logs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" check="all" comment="tests the absence of write_logs setting in the /etc/audit/auditd.conf file" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" check="all" comment="tests the value of removal-action setting in the /etc/dconf/db/local.d/ file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" check="all" comment="Prevent user from modifying removal-action" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_prevent_user_removal-action:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_0:tst:1" version="1" check="all" comment="Testing group ownership of /lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_1:tst:1" version="1" check="all" comment="Testing group ownership of /lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_2:tst:1" version="1" check="all" comment="Testing group ownership of /usr/lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdir_group_ownership_library_dirs_3:tst:1" version="1" check="all" comment="Testing group ownership of /usr/lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_0:tst:1" version="1" check="all" comment="Testing user ownership of /bin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_1:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_2:tst:1" version="1" check="all" comment="Testing user ownership of /usr/bin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_3:tst:1" version="1" check="all" comment="Testing user ownership of /usr/sbin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_4:tst:1" version="1" check="all" comment="Testing user ownership of /usr/local/bin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_4:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_binary_dirs_5:tst:1" version="1" check="all" comment="Testing user ownership of /usr/local/sbin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_binary_dirs_5:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_0:tst:1" version="1" check="all" comment="Testing user ownership of /lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_1:tst:1" version="1" check="all" comment="Testing user ownership of /lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_2:tst:1" version="1" check="all" comment="Testing user ownership of /usr/lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdir_ownership_library_dirs_3:tst:1" version="1" check="all" comment="Testing user ownership of /usr/lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_0:tst:1" version="3" check="all" comment="Testing mode of /bin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_1:tst:1" version="3" check="all" comment="Testing mode of /sbin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_2:tst:1" version="3" check="all" comment="Testing mode of /usr/bin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_3:tst:1" version="3" check="all" comment="Testing mode of /usr/sbin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_4:tst:1" version="3" check="all" comment="Testing mode of /usr/local/bin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_binary_dirs_5:tst:1" version="3" check="all" comment="Testing mode of /usr/local/sbin/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_0:tst:1" version="3" check="all" comment="Testing mode of /lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_1:tst:1" version="3" check="all" comment="Testing mode of /lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_2:tst:1" version="3" check="all" comment="Testing mode of /usr/lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdir_permissions_library_dirs_3:tst:1" version="3" check="all" comment="Testing mode of /usr/lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdirectory_groupowner_etc_ipsecd_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/ipsec.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdirectory_groupowner_etc_ipsecd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdirectory_groupowner_etc_iptables_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/iptables/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdirectory_groupowner_etc_iptables_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdirectory_groupowner_etc_nftables_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/nftables/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdirectory_groupowner_etc_nftables_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdirectory_groupowner_etc_selinux_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/selinux/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdirectory_groupowner_etc_selinux_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdirectory_groupowner_etc_sudoersd_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/sudoers.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdirectory_groupowner_etc_sudoersd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerdirectory_groupowner_etc_sysctld_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/sysctl.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerdirectory_groupowner_etc_sysctld_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdirectory_owner_etc_ipsecd_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/ipsec.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdirectory_owner_etc_ipsecd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdirectory_owner_etc_iptables_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/iptables/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdirectory_owner_etc_iptables_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdirectory_owner_etc_nftables_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/nftables/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdirectory_owner_etc_nftables_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdirectory_owner_etc_selinux_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/selinux/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdirectory_owner_etc_selinux_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdirectory_owner_etc_sudoersd_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/sudoers.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdirectory_owner_etc_sudoersd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerdirectory_owner_etc_sysctld_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/sysctl.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerdirectory_owner_etc_sysctld_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdirectory_permissions_etc_ipsecd_0:tst:1" version="3" check="all" comment="Testing mode of /etc/ipsec.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdirectory_permissions_etc_ipsecd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdirectory_permissions_etc_iptables_0:tst:1" version="3" check="all" comment="Testing mode of /etc/iptables/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdirectory_permissions_etc_iptables_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdirectory_permissions_etc_nftables_0:tst:1" version="3" check="all" comment="Testing mode of /etc/nftables/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdirectory_permissions_etc_nftables_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdirectory_permissions_etc_selinux_0:tst:1" version="3" check="all" comment="Testing mode of /etc/selinux/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdirectory_permissions_etc_selinux_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdirectory_permissions_etc_sudoersd_0:tst:1" version="3" check="all" comment="Testing mode of /etc/sudoers.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdirectory_permissions_etc_sudoersd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsdirectory_permissions_etc_sysctld_0:tst:1" version="3" check="all" comment="Testing mode of /etc/sysctl.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsdirectory_permissions_etc_sysctld_0:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_host_auth_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of HostbasedAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_disable_host_auth_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_disable_host_auth:tst:1" version="1" check="all" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_disable_host_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_HostbasedAuthentication_present_disable_host_auth:tst:1" version="1" check="all" comment="Verify that the value of HostbasedAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_disable_host_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_file_at_deny_not_exist:tst:1" version="1" check="all" comment="Test that that /etc/at.deny does not exist" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_at_deny_not_exist:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_0:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/auditctl" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_1:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/aureport" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_2:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/ausearch" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_3:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/autrace" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_4:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/auditd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_4:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_5:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/rsyslogd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_5:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_6:tst:1" version="1" check="all" comment="Testing group ownership of /sbin/augenrules" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_6:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_0:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/auditctl" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_1:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/aureport" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_2:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/ausearch" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_3:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/autrace" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_4:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/auditd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_4:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_5:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/rsyslogd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_5:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownerfile_audit_tools_ownership_6:tst:1" version="1" check="all" comment="Testing user ownership of /sbin/augenrules" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownerfile_audit_tools_ownership_6:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_0:tst:1" version="3" check="all" comment="Testing mode of /sbin/auditctl" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_1:tst:1" version="3" check="all" comment="Testing mode of /sbin/aureport" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_2:tst:1" version="3" check="all" comment="Testing mode of /sbin/ausearch" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_3:tst:1" version="3" check="all" comment="Testing mode of /sbin/autrace" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_4:tst:1" version="3" check="all" comment="Testing mode of /sbin/auditd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_4:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_5:tst:1" version="3" check="all" comment="Testing mode of /sbin/rsyslogd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_5:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissionsfile_audit_tools_permissions_6:tst:1" version="3" check="all" comment="Testing mode of /sbin/augenrules" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissionsfile_audit_tools_permissions_6:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_cron_deny_not_exist:tst:1" version="1" check="all" comment="Test that that /etc/cron.deny does not exist" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_cron_deny_not_exist:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_at_allow_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/at.allow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_at_allow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/group-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/gshadow-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/passwd-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/shadow-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_allow_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.allow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_allow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_d_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_d_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_daily_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.daily/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_daily_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_deny_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.deny" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_deny_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_hourly_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.hourly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_hourly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_monthly_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.monthly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_monthly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_cron_weekly_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/cron.weekly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_cron_weekly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_crontab_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/crontab" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_crontab_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_efi_grub2_cfg_0:tst:1" version="1" check="all" comment="Testing group ownership of /boot/grub2/grub.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_efi_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_efi_user_cfg_0:tst:1" version="1" check="all" comment="Testing group ownership of /boot/grub2/user.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_efi_user_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_crypttab_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/crypttab" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_crypttab_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_group_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/group" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/gshadow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_ipsec_conf_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/ipsec.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_ipsec_conf_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_ipsec_secrets_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/ipsec.secrets" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_ipsec_secrets_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_issue_net_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/issue.net" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_issue_net_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_passwd_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/passwd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_sestatus_conf_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/sestatus.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_sestatus_conf_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_shadow_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/shadow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_shells_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/shells" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_shells_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_etc_sudoers_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_sudoers_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_grub2_cfg_0:tst:1" version="1" check="all" comment="Testing group ownership of /boot/grub2/grub.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_sshd_config_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/ssh/sshd_config" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_sshd_config_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_systemmap_0:tst:1" version="1" check="all" comment="Testing group ownership of /boot/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_systemmap_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_user_cfg_0:tst:1" version="1" check="all" comment="Testing group ownership of /boot/grub2/user.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_user_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_var_log_0:tst:1" version="1" check="all" comment="Testing group ownership of /var/log/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_var_log_messages_0:tst:1" version="1" check="all" comment="Testing group ownership of /var/log/messages" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_messages_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupowner_var_log_syslog_0:tst:1" version="1" check="all" comment="Testing group ownership of /var/log/syslog" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_syslog_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownership_audit_configuration_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/audit/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownership_audit_configuration_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownership_audit_configuration_1:tst:1" version="1" check="all" comment="Testing group ownership of /etc/audit/rules.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownership_audit_configuration_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownership_sshd_private_key_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/ssh/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownership_sshd_private_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownership_sshd_pub_key_0:tst:1" version="1" check="all" comment="Testing group ownership of /etc/ssh/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownership_sshd_pub_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_backup_etc_group_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/group-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/gshadow-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/passwd-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/shadow-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_allow_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.allow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_allow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_d_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_d_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_daily_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.daily/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_daily_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_deny_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.deny" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_deny_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_hourly_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.hourly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_hourly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_monthly_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.monthly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_monthly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_cron_weekly_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/cron.weekly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_cron_weekly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_crontab_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/crontab" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_crontab_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_efi_grub2_cfg_0:tst:1" version="1" check="all" comment="Testing user ownership of /boot/grub2/grub.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_efi_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_efi_user_cfg_0:tst:1" version="1" check="all" comment="Testing user ownership of /boot/grub2/user.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_efi_user_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_chrony_keys_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/chrony.keys" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_chrony_keys_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_crypttab_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/crypttab" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_crypttab_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_group_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/group" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_gshadow_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/gshadow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_ipsec_conf_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/ipsec.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_ipsec_conf_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_ipsec_secrets_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/ipsec.secrets" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_ipsec_secrets_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_issue_net_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/issue.net" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_issue_net_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_passwd_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/passwd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_sestatus_conf_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/sestatus.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_sestatus_conf_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_shadow_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/shadow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_shells_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/shells" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_shells_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_etc_sudoers_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_sudoers_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_grub2_cfg_0:tst:1" version="1" check="all" comment="Testing user ownership of /boot/grub2/grub.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_sshd_config_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/ssh/sshd_config" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_sshd_config_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_systemmap_0:tst:1" version="1" check="all" comment="Testing user ownership of /boot/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_systemmap_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_user_cfg_0:tst:1" version="1" check="all" comment="Testing user ownership of /boot/grub2/user.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_user_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_var_log_0:tst:1" version="1" check="all" comment="Testing user ownership of /var/log/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_var_log_messages_0:tst:1" version="1" check="all" comment="Testing user ownership of /var/log/messages" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_messages_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_owner_var_log_syslog_0:tst:1" version="1" check="all" comment="Testing user ownership of /var/log/syslog" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_syslog_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_audit_configuration_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/audit/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_audit_configuration_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_audit_configuration_1:tst:1" version="1" check="all" comment="Testing user ownership of /etc/audit/rules.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_audit_configuration_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_library_dirs_0:tst:1" version="1" check="all" comment="Testing user ownership of /lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_library_dirs_1:tst:1" version="1" check="all" comment="Testing user ownership of /lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_library_dirs_2:tst:1" version="1" check="all" comment="Testing user ownership of /usr/lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_library_dirs_3:tst:1" version="1" check="all" comment="Testing user ownership of /usr/lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_sshd_private_key_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/ssh/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_sshd_private_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_ownership_sshd_pub_key_0:tst:1" version="1" check="all" comment="Testing user ownership of /etc/ssh/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_ownership_sshd_pub_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_at_allow_0:tst:1" version="3" check="all" comment="Testing mode of /etc/at.allow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_at_allow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_audit_configuration_0:tst:1" version="3" check="all" comment="Testing mode of /etc/audit/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_audit_configuration_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_audit_configuration_1:tst:1" version="3" check="all" comment="Testing mode of /etc/audit/rules.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_audit_configuration_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_backup_etc_group_0:tst:1" version="3" check="all" comment="Testing mode of /etc/group-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_backup_etc_gshadow_0:tst:1" version="3" check="all" comment="Testing mode of /etc/gshadow-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_backup_etc_passwd_0:tst:1" version="3" check="all" comment="Testing mode of /etc/passwd-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_backup_etc_shadow_0:tst:1" version="3" check="all" comment="Testing mode of /etc/shadow-" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_cron_allow_0:tst:1" version="3" check="all" comment="Testing mode of /etc/cron.allow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_cron_allow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_cron_d_0:tst:1" version="3" check="all" comment="Testing mode of /etc/cron.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_cron_d_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_cron_daily_0:tst:1" version="3" check="all" comment="Testing mode of /etc/cron.daily/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_cron_daily_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_cron_hourly_0:tst:1" version="3" check="all" comment="Testing mode of /etc/cron.hourly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_cron_hourly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_cron_monthly_0:tst:1" version="3" check="all" comment="Testing mode of /etc/cron.monthly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_cron_monthly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_cron_weekly_0:tst:1" version="3" check="all" comment="Testing mode of /etc/cron.weekly/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_cron_weekly_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_crontab_0:tst:1" version="3" check="all" comment="Testing mode of /etc/crontab" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_crontab_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_efi_grub2_cfg_0:tst:1" version="3" check="all" comment="Testing mode of /boot/grub2/grub.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_efi_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_efi_user_cfg_0:tst:1" version="3" check="all" comment="Testing mode of /boot/grub2/user.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_efi_user_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_audit_auditd_0:tst:1" version="3" check="all" comment="Testing mode of /etc/audit/auditd.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_audit_auditd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_audit_rulesd_0:tst:1" version="3" check="all" comment="Testing mode of /etc/audit/rules.d/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_audit_rulesd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_chrony_keys_0:tst:1" version="3" check="all" comment="Testing mode of /etc/chrony.keys" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_chrony_keys_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_crypttab_0:tst:1" version="3" check="all" comment="Testing mode of /etc/crypttab" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_crypttab_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_group_0:tst:1" version="3" check="all" comment="Testing mode of /etc/group" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_group_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_gshadow_0:tst:1" version="3" check="all" comment="Testing mode of /etc/gshadow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_gshadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_ipsec_conf_0:tst:1" version="3" check="all" comment="Testing mode of /etc/ipsec.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_ipsec_conf_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_ipsec_secrets_0:tst:1" version="3" check="all" comment="Testing mode of /etc/ipsec.secrets" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_ipsec_secrets_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_issue_net_0:tst:1" version="3" check="all" comment="Testing mode of /etc/issue.net" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_issue_net_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_passwd_0:tst:1" version="3" check="all" comment="Testing mode of /etc/passwd" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_passwd_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_sestatus_conf_0:tst:1" version="3" check="all" comment="Testing mode of /etc/sestatus.conf" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_sestatus_conf_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_shadow_0:tst:1" version="3" check="all" comment="Testing mode of /etc/shadow" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_shadow_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_shells_0:tst:1" version="3" check="all" comment="Testing mode of /etc/shells" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_shells_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_etc_sudoers_0:tst:1" version="3" check="all" comment="Testing mode of /etc/sudoers" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_sudoers_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_grub2_cfg_0:tst:1" version="3" check="all" comment="Testing mode of /boot/grub2/grub.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_grub2_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_library_dirs_0:tst:1" version="3" check="all" comment="Testing mode of /lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_library_dirs_1:tst:1" version="3" check="all" comment="Testing mode of /lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_library_dirs_2:tst:1" version="3" check="all" comment="Testing mode of /usr/lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_library_dirs_3:tst:1" version="3" check="all" comment="Testing mode of /usr/lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_library_dirs_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_sshd_config_0:tst:1" version="3" check="all" comment="Testing mode of /etc/ssh/sshd_config" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_sshd_config_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_sshd_pub_key_0:tst:1" version="3" check="all" comment="Testing mode of /etc/ssh/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_sudo_0:tst:1" version="3" check="all" comment="Testing mode of /usr/bin/sudo" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_sudo_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_systemmap_0:tst:1" version="3" check="all" comment="Testing mode of /boot/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_systemmap_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_user_cfg_0:tst:1" version="3" check="all" comment="Testing mode of /boot/grub2/user.cfg" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_user_cfg_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_var_log_0:tst:1" version="3" check="all" comment="Testing mode of /var/log/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_var_log_messages_0:tst:1" version="3" check="all" comment="Testing mode of /var/log/messages" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_messages_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_permissions_var_log_syslog_0:tst:1" version="3" check="all" comment="Testing mode of /var/log/syslog" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_syslog_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_sshd_50_redhat_exists:tst:1" version="1" check="all" comment="Test that that /etc/ssh/sshd_config.d/50-redhat.conf does exist" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_sshd_50_redhat_exists:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_firewalld-backend:tst:1" version="1" check="all" comment="tests the value of FirewallBackend setting in the /etc/firewalld/firewalld.conf file" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_firewalld-backend:obj:1"/>
          <ind:state state_ref="oval:ssg-state_firewalld-backend:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument:tst:1" version="1" check="all" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_audit_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument_default:tst:1" version="1" check="all" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_audit_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for audit=1 for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_audit_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument:tst:1" version="1" check="all" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument_default:tst:1" version="1" check="all" comment="check for audit_backlog_limit=8192 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for audit_backlog_limit=8192 for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_audit_backlog_limit_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument:tst:1" version="1" check="all" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_iommu_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument_default:tst:1" version="1" check="all" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_iommu_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_iommu_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for iommu=force for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_iommu_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_init_on_alloc_argument:tst:1" version="1" check="all" comment="check for init_on_alloc=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_init_on_alloc_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_init_on_alloc_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_init_on_alloc_argument_default:tst:1" version="1" check="all" comment="check for init_on_alloc=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_init_on_alloc_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_init_on_alloc_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_init_on_alloc_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for init_on_alloc=1 for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_init_on_alloc_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_init_on_alloc_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_argument:tst:1" version="1" check="all" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_l1tf_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_argument_default:tst:1" version="1" check="all" comment="check for l1tf in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_l1tf_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_l1tf_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for l1tf for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_l1tf_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_l1tf_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mce_argument:tst:1" version="1" check="all" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_mce_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mce_argument_default:tst:1" version="1" check="all" comment="check for mce=0 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_mce_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mce_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for mce=0 for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_mce_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mce_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mds_argument:tst:1" version="1" check="all" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_mds_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mds_argument_default:tst:1" version="1" check="all" comment="check for mds in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_mds_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_mds_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for mds for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_mds_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_mds_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_argument_absent:tst:1" version="1" check="all" comment="check for absence nosmap in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_nosmap_argument_absent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_argument_absent_default:tst:1" version="1" check="all" comment="check for absence nosmap in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_nosmap_argument_absent_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmap_entries:tst:1" version="1" check="all" comment="check absence of kernel command line parameters nosmap on all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_nosmap_entries:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_argument_absent:tst:1" version="1" check="all" comment="check for absence nosmep in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_nosmep_argument_absent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_argument_absent_default:tst:1" version="1" check="all" comment="check for absence nosmep in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_nosmep_argument_absent_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_nosmep_entries:tst:1" version="1" check="all" comment="check absence of kernel command line parameters nosmep on all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_nosmep_entries:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_alloc_shuffle_argument:tst:1" version="1" check="all" comment="check for page_alloc.shuffle=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_page_alloc_shuffle_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_alloc_shuffle_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_alloc_shuffle_argument_default:tst:1" version="1" check="all" comment="check for page_alloc.shuffle=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_page_alloc_shuffle_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_alloc_shuffle_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_alloc_shuffle_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for page_alloc.shuffle=1 for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_page_alloc_shuffle_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_alloc_shuffle_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument:tst:1" version="1" check="all" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_page_poison_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument_default:tst:1" version="1" check="all" comment="check for page_poison=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_page_poison_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for page_poison=1 for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_page_poison_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument:tst:1" version="1" check="all" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_pti_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument_default:tst:1" version="1" check="all" comment="check for pti=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_pti_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_pti_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for pti=on for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_pti_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_argument:tst:1" version="1" check="all" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_rng_core_default_quality_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_argument_default:tst:1" version="1" check="all" comment="check for rng_core.default_quality in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_rng_core_default_quality_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_rng_core_default_quality_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for rng_core.default_quality for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_rng_core_default_quality_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_argument:tst:1" version="1" check="all" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_slab_nomerge_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_argument_default:tst:1" version="1" check="all" comment="check for slab_nomerge=yes in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_slab_nomerge_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slab_nomerge_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for slab_nomerge=yes for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_slab_nomerge_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slab_nomerge_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument:tst:1" version="1" check="all" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_slub_debug_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument_default:tst:1" version="1" check="all" comment="check for slub_debug in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_slub_debug_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for slub_debug for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_slub_debug_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_argument:tst:1" version="1" check="all" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_spec_store_bypass_disable_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_argument_default:tst:1" version="1" check="all" comment="check for spec_store_bypass_disable in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_spec_store_bypass_disable_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spec_store_bypass_disable_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for spec_store_bypass_disable for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_spec_store_bypass_disable_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_argument:tst:1" version="1" check="all" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_spectre_v2_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_argument_default:tst:1" version="1" check="all" comment="check for spectre_v2=on in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_spectre_v2_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_spectre_v2_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for spectre_v2=on for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_spectre_v2_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_spectre_v2_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_systemd_debug_shell_argument_absent:tst:1" version="1" check="all" comment="check for absence systemd.debug-shell in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_systemd_debug_shell_argument_absent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_systemd_debug_shell_argument_absent_default:tst:1" version="1" check="all" comment="check for absence systemd.debug-shell in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_systemd_debug_shell_argument_absent_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_systemd_debug_shell_entries:tst:1" version="1" check="all" comment="check absence of kernel command line parameters systemd.debug-shell on all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_systemd_debug_shell_entries:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument:tst:1" version="1" check="all" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_vsyscall_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument_default:tst:1" version="1" check="all" comment="check for vsyscall=none in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_vsyscall_argument_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_entries:tst:1" version="1" check="all" comment="check kernel command line parameters for vsyscall=none for all boot entries." check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_grub2_vsyscall_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" check="all" comment="package openssl-pkcs11 is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_acpi_custom_method:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_ACPI_CUSTOM_METHOD=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_acpi_custom_method:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_acpi_custom_method_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_ACPI_CUSTOM_METHOD" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_acpi_custom_method_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_acpi_custom_method_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_acpi_custom_method:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_arm64_sw_ttbr0_pan:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_ARM64_SW_TTBR0_PAN=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_arm64_sw_ttbr0_pan:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_arm64_sw_ttbr0_pan_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_arm64_sw_ttbr0_pan_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_arm64_sw_ttbr0_pan:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_binfmt_misc:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_BINFMT_MISC=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_binfmt_misc:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_binfmt_misc_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_BINFMT_MISC" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_binfmt_misc_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_binfmt_misc_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_binfmt_misc:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_bug:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_BUG=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_bug:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_bug:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_bug_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_bug_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_bug:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_bug_on_data_corruption:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_BUG_ON_DATA_CORRUPTION=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_bug_on_data_corruption:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_bug_on_data_corruption_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_bug_on_data_corruption_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_bug_on_data_corruption:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_brk:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_COMPAT_BRK=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_compat_brk:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_brk_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_COMPAT_BRK" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_compat_brk_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_compat_brk_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_compat_brk:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_vdso:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_COMPAT_VDSO=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_compat_vdso:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_compat_vdso_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_COMPAT_VDSO" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_compat_vdso_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_compat_vdso_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_compat_vdso:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_credentials:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_CREDENTIALS=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_credentials:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_credentials:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_debug_credentials_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_credentials_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_credentials:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_fs:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_FS=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_fs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_fs_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_DEBUG_FS" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_debug_fs_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_fs_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_fs:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_list:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_LIST=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_list:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_list:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_debug_list_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_list_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_list:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_notifiers:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_NOTIFIERS=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_notifiers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_notifiers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_debug_notifiers_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_notifiers_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_notifiers:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_sg:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_SG=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_sg:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_sg:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_debug_sg_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_sg_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_sg:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_debug_wx:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEBUG_WX=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_debug_wx:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_debug_wx:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_debug_wx_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_debug_wx_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_debug_wx:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_devkmem:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_DEVKMEM=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_devkmem:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_devkmem:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_devkmem_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_DEVKMEM" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_devkmem:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_devkmem_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_devkmem_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_devkmem:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_fortify_source:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_FORTIFY_SOURCE=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_fortify_source:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_fortify_source:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_fortify_source_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_fortify_source_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_fortify_source:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_latent_entropy:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_latent_entropy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_latent_entropy_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_latent_entropy_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_latent_entropy:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_randstruct:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_RANDSTRUCT=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_randstruct:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_randstruct_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_randstruct_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_randstruct:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_stackleak:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STACKLEAK=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_stackleak:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_stackleak_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_stackleak_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_stackleak:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_structleak:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STRUCTLEAK=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_structleak:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_structleak:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_gcc_plugin_structleak_byref_all:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_gcc_plugin_structleak_byref_all:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_gcc_plugin_structleak_byref_all_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_byref_all_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_gcc_plugin_structleak_byref_all:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_hardened_usercopy:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_HARDENED_USERCOPY=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_hardened_usercopy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_hardened_usercopy_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_hardened_usercopy_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_hardened_usercopy:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_hardened_usercopy_fallback:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_HARDENED_USERCOPY_FALLBACK=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_hardened_usercopy_fallback:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_hardened_usercopy_fallback_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_HARDENED_USERCOPY_FALLBACK" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_hardened_usercopy_fallback_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_hardened_usercopy_fallback_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_hardened_usercopy_fallback:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_hibernation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_HIBERNATION=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_hibernation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_hibernation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_hibernation_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_HIBERNATION" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_hibernation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_hibernation_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_hibernation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_hibernation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_ia32_emulation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_IA32_EMULATION=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_ia32_emulation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_ia32_emulation_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_IA32_EMULATION" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_ia32_emulation_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_ia32_emulation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_ia32_emulation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_ipv6:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_IPV6=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_ipv6_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_IPV6" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_ipv6_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_ipv6_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_ipv6:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_kexec:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_KEXEC=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_kexec:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_kexec:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_kexec_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_KEXEC" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_kexec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_kexec_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_kexec_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_kexec:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_ptys:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_PTYS=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_ptys:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_ptys_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_PTYS" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_legacy_ptys_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_ptys_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_ptys:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_EMULATE=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_emulate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_emulate_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_VSYSCALL_EMULATE" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_legacy_vsyscall_emulate_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_emulate_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_emulate:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_none:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_NONE=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_none:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_legacy_vsyscall_none_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_none_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_none:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_LEGACY_VSYSCALL_XONLY=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_legacy_vsyscall_xonly:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_legacy_vsyscall_xonly_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_LEGACY_VSYSCALL_XONLY" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_legacy_vsyscall_xonly_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_legacy_vsyscall_xonly_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_legacy_vsyscall_xonly:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_modify_ldt_syscall:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODIFY_LDT_SYSCALL=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_modify_ldt_syscall:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_modify_ldt_syscall_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_MODIFY_LDT_SYSCALL" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_modify_ldt_syscall_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_modify_ldt_syscall_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_modify_ldt_syscall:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_module_sig_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_all:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_ALL=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_all:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_all:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_module_sig_all_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_all_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_all:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_force:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_FORCE=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_force:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_force:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_module_sig_force_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_force_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_force:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_hash:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_HASH according to var_kernel_config_module_sig_hash" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_hash:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_hash:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_module_sig_hash_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_hash_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_hash:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_key:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_KEY according to var_kernel_config_module_sig_key" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_key:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_key:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_module_sig_key_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_key_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_key:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_module_sig_sha512:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_MODULE_SIG_SHA512=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_module_sig_sha512:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_module_sig_sha512:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_module_sig_sha512_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_module_sig_sha512_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_module_sig_sha512:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_page_poisoning:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_poisoning:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_poisoning:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_page_poisoning_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_page_poisoning_no_sanity:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING_NO_SANITY=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_poisoning_no_sanity:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_page_poisoning_no_sanity_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_no_sanity_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning_no_sanity:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_page_poisoning_zero:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_POISONING_ZERO=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_poisoning_zero:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_page_poisoning_zero_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_poisoning_zero_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_poisoning_zero:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_page_table_isolation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PAGE_TABLE_ISOLATION=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_page_table_isolation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_page_table_isolation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_page_table_isolation_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_page_table_isolation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_page_table_isolation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_panic_on_oops:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PANIC_ON_OOPS=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_panic_on_oops_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_panic_on_oops_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_panic_on_oops:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_panic_timeout:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PANIC_TIMEOUT according to var_kernel_config_panic_timeout" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_panic_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_panic_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_panic_timeout_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_panic_timeout_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_panic_timeout:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_proc_kcore:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_PROC_KCORE=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_proc_kcore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_proc_kcore_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_PROC_KCORE" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_proc_kcore_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_proc_kcore_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_proc_kcore:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_randomize_base:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_RANDOMIZE_BASE=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_randomize_base:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_randomize_base:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_randomize_base_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_randomize_base_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_randomize_base:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_randomize_memory:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_RANDOMIZE_MEMORY=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_randomize_memory:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_randomize_memory:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_randomize_memory_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_randomize_memory_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_randomize_memory:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_refcount_full:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_REFCOUNT_FULL=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_refcount_full:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_refcount_full:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_refcount_full_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_refcount_full_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_refcount_full:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_retpoline:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_RETPOLINE=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_retpoline:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_retpoline:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_retpoline_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_retpoline_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_retpoline:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_sched_stack_end_check:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SCHED_STACK_END_CHECK=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_sched_stack_end_check:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_sched_stack_end_check_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_sched_stack_end_check_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_sched_stack_end_check:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_seccomp:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECCOMP=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_seccomp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_seccomp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_seccomp_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_seccomp_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_seccomp:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_seccomp_filter:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECCOMP_FILTER=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_seccomp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_seccomp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_seccomp_filter_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_seccomp_filter_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_seccomp_filter:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_security:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_security:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_security_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_security_dmesg_restrict:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_DMESG_RESTRICT=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_security_dmesg_restrict_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_dmesg_restrict_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security_dmesg_restrict:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_security_writable_hooks:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_WRITABLE_HOOKS=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security_writable_hooks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_security_writable_hooks_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_SECURITY_WRITABLE_HOOKS" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_security_writable_hooks_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_writable_hooks_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security_writable_hooks:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_security_yama:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SECURITY_YAMA=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_security_yama:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_security_yama:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_security_yama_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_security_yama_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_security_yama:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_freelist_hardened:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_FREELIST_HARDENED=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slab_freelist_hardened:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_slab_freelist_hardened_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slab_freelist_hardened_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slab_freelist_hardened:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_freelist_random:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_FREELIST_RANDOM=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_freelist_random:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slab_freelist_random:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_slab_freelist_random_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slab_freelist_random_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slab_freelist_random:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_merge_default:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLAB_MERGE_DEFAULT=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slab_merge_default:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_slab_merge_default_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_SLAB_MERGE_DEFAULT" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_slab_merge_default_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slab_merge_default_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slab_merge_default:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_slub_debug:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SLUB_DEBUG=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_slub_debug:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_slub_debug:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_slub_debug_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_slub_debug_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_slub_debug:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_stackprotector:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STACKPROTECTOR=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_stackprotector:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_stackprotector:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_stackprotector_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_stackprotector_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_stackprotector:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_stackprotector_strong:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STACKPROTECTOR_STRONG=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_stackprotector_strong:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_stackprotector_strong:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_stackprotector_strong_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_stackprotector_strong_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_stackprotector_strong:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_strict_kernel_rwx:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STRICT_KERNEL_RWX=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_strict_kernel_rwx:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_strict_kernel_rwx_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_strict_kernel_rwx_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_strict_kernel_rwx:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_strict_module_rwx:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_STRICT_MODULE_RWX=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_strict_module_rwx:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_strict_module_rwx:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_strict_module_rwx_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_strict_module_rwx_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_strict_module_rwx:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_syn_cookies:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_SYN_COOKIES=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_syn_cookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_syn_cookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_syn_cookies_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_syn_cookies_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_syn_cookies:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_unmap_kernel_at_el0:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_UNMAP_KERNEL_AT_EL0=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_unmap_kernel_at_el0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_unmap_kernel_at_el0_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_unmap_kernel_at_el0_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_unmap_kernel_at_el0:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_vmap_stack:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_VMAP_STACK=y" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_vmap_stack:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_vmap_stack:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_vmap_stack_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_vmap_stack_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_vmap_stack:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_x86_vsyscall_emulation:tst:1" version="1" check="all" comment="Check /boot/config-.* files for CONFIG_X86_VSYSCALL_EMULATION=n" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_kernel_config_x86_vsyscall_emulation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_config_x86_vsyscall_emulation_absence:tst:1" version="1" check="all" comment="Check /boot/config-.* files for absence of CONFIG_X86_VSYSCALL_EMULATION" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_all_kernels_config_x86_vsyscall_emulation_compliant:tst:1" version="1" check="all" comment="Check if all installed kernels are compliant" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_kernel_config_x86_vsyscall_emulation_count:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_kernel_config_x86_vsyscall_emulation:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" comment="kernel module atm disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_blacklisted:tst:1" version="1" check="all" comment="kernel module atm blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_blacklisted:tst:1" version="1" check="all" comment="kernel module bluetooth blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" comment="kernel module can disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_blacklisted:tst:1" version="1" check="all" comment="kernel module can blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_blacklisted:tst:1" version="1" check="all" comment="kernel module cramfs blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_blacklisted:tst:1" version="1" check="all" comment="kernel module dccp blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" comment="kernel module firewire-core disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_blacklisted:tst:1" version="1" check="all" comment="kernel module firewire-core blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" comment="kernel module rds disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_blacklisted:tst:1" version="1" check="all" comment="kernel module rds blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_disabled:tst:1" version="1" check="all" comment="kernel module sctp disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_sctp_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_blacklisted:tst:1" version="1" check="all" comment="kernel module sctp blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_sctp_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_blacklisted:tst:1" version="1" check="all" comment="kernel module squashfs blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" comment="kernel module tipc disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_blacklisted:tst:1" version="1" check="all" comment="kernel module tipc blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_blacklisted:tst:1" version="1" check="all" comment="kernel module udf blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_blacklisted:tst:1" version="1" check="all" comment="kernel module usb-storage blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_uvcvideo_disabled:tst:1" version="1" check="all" comment="kernel module uvcvideo disabled" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_uvcvideo_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_uvcvideo_blacklisted:tst:1" version="1" check="all" comment="kernel module uvcvideo blacklisted" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_kernmod_uvcvideo_blacklisted:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_efi_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /boot/efi " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_efi_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_efi_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_efi_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /boot/efi  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_efi_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_boot_efi_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_efi_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/boot/efi exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_efi_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_efi_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/boot/efi exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_efi_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /boot " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /boot  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_boot_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/boot exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/boot exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_partition_noexec_optional:tst:1" version="2" check="all" comment="noexec on /boot " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_partition_noexec_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_noexec_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_partition_noexec_optional_in_fstab:tst:1" version="1" check="all" comment="noexec on /boot  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_partition_noexec_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_boot_partition_noexec_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_partition_noexec_optional_exist:tst:1" version="1" check="all" comment="/boot exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_partition_noexec_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_partition_noexec_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/boot exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_partition_noexec_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /boot " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /boot  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_boot_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_boot_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/boot exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_boot_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_boot_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/boot exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_boot_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_dev_shm_partition_nodev_expected:tst:1" version="2" check="all" comment="nodev on /dev/shm " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev_expected:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_nodev_expected:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dev_shm_partition_nodev_expected_in_fstab:tst:1" version="1" check="all" comment="nodev on /dev/shm  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_dev_shm_partition_nodev_expected_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dev_shm_partition_nodev_expected_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_dev_shm_partition_nodev_expected_exist:tst:1" version="1" check="all" comment="/dev/shm exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev_expected:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-test_dev_shm_partition_noexec_expected:tst:1" version="2" check="all" comment="noexec on /dev/shm " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec_expected:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_noexec_expected:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dev_shm_partition_noexec_expected_in_fstab:tst:1" version="1" check="all" comment="noexec on /dev/shm  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_dev_shm_partition_noexec_expected_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dev_shm_partition_noexec_expected_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_dev_shm_partition_noexec_expected_exist:tst:1" version="1" check="all" comment="/dev/shm exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec_expected:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-test_dev_shm_partition_nosuid_expected:tst:1" version="2" check="all" comment="nosuid on /dev/shm " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_expected:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_nosuid_expected:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_dev_shm_partition_nosuid_expected_in_fstab:tst:1" version="1" check="all" comment="nosuid on /dev/shm  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_expected_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dev_shm_partition_nosuid_expected_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_dev_shm_partition_nosuid_expected_exist:tst:1" version="1" check="all" comment="/dev/shm exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_expected:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-test_home_partition_grpquota:tst:1" version="1" check="all" comment="grpquota on Home mount points" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_home_partitions_grpquota:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_grpquota:ste:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-test_home_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /home " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_home_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_home_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /home  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_home_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_home_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_home_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/home exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_home_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_home_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/home exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_home_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_home_partition_noexec:tst:1" version="1" check="all" comment="noexec on Home mount points" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_home_partitions_noexec:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_noexec:ste:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-test_home_partition_nosuid:tst:1" version="1" check="all" comment="nosuid on Home mount points" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_home_partitions_nosuid:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_nosuid:ste:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-test_home_partition_usrquota:tst:1" version="1" check="all" comment="usrquota on Home mount points" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_home_partitions_usrquota:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_usrquota:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nfs_sec_krb5_krb5i_krb5p_etc_fstab:tst:1" version="1" check="all" comment="all nfs has sec_krb5_krb5i_krb5p" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nfs_sec_krb5_krb5i_krb5p_etc_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_remote_filesystem_sec_krb5_krb5i_krb5p:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nfs_nodev_etc_fstab:tst:1" version="1" check="all" comment="all nfs has nodev" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nfs_nodev_etc_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_remote_filesystem_nodev:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check="at least one" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nfs_noexec_etc_fstab:tst:1" version="1" check="all" comment="all nfs has noexec" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nfs_noexec_etc_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_remote_filesystem_noexec:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check="at least one" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nfs_nosuid_etc_fstab:tst:1" version="1" check="all" comment="all nfs has nosuid" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nfs_nosuid_etc_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_remote_filesystem_nosuid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check="at least one" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_opt_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /opt " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_opt_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opt_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_opt_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /opt  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_opt_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_opt_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_opt_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/opt exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_opt_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_opt_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/opt exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_opt_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_srv_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /srv " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_srv_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_srv_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_srv_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /srv  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_srv_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_srv_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_srv_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/srv exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_srv_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_srv_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/srv exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_srv_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_tmp_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /tmp " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /tmp  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tmp_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_tmp_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_tmp_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/tmp exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tmp_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_tmp_partition_noexec_optional:tst:1" version="2" check="all" comment="noexec on /tmp " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_tmp_partition_noexec_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_noexec_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_partition_noexec_optional_in_fstab:tst:1" version="1" check="all" comment="noexec on /tmp  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tmp_partition_noexec_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_tmp_partition_noexec_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_tmp_partition_noexec_optional_exist:tst:1" version="1" check="all" comment="/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_tmp_partition_noexec_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_partition_noexec_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/tmp exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tmp_partition_noexec_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_tmp_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /tmp " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /tmp  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_tmp_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_tmp_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_tmp_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/tmp exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_audit_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /var/log/audit " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_audit_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /var/log/audit  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_log_audit_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_audit_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/var/log/audit exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_audit_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/log/audit exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_audit_partition_noexec_optional:tst:1" version="2" check="all" comment="noexec on /var/log/audit " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_noexec_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_audit_partition_noexec_optional_in_fstab:tst:1" version="1" check="all" comment="noexec on /var/log/audit  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_log_audit_partition_noexec_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_audit_partition_noexec_optional_exist:tst:1" version="1" check="all" comment="/var/log/audit exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_audit_partition_noexec_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/log/audit exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_audit_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /var/log/audit " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_audit_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /var/log/audit  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_log_audit_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_audit_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/var/log/audit exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_audit_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/log/audit exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /var/log " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /var/log  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_log_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/var/log exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/log exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_partition_noexec_optional:tst:1" version="2" check="all" comment="noexec on /var/log " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_partition_noexec_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_noexec_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_partition_noexec_optional_in_fstab:tst:1" version="1" check="all" comment="noexec on /var/log  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_partition_noexec_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_log_partition_noexec_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_partition_noexec_optional_exist:tst:1" version="1" check="all" comment="/var/log exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_partition_noexec_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_partition_noexec_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/log exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_partition_noexec_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /var/log " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /var/log  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_log_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_log_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/var/log exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_log_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/log exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /var " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /var  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/var exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_partition_noexec_optional:tst:1" version="2" check="all" comment="noexec on /var " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_partition_noexec_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_noexec_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_partition_noexec_optional_in_fstab:tst:1" version="1" check="all" comment="noexec on /var  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_partition_noexec_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_partition_noexec_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_partition_noexec_optional_exist:tst:1" version="1" check="all" comment="/var exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_partition_noexec_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_partition_noexec_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_partition_noexec_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /var " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /var  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/var exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_tmp_partition_nodev_optional:tst:1" version="2" check="all" comment="nodev on /var/tmp " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_tmp_partition_nodev_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_tmp_partition_nodev_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_partition_nodev_optional_in_fstab:tst:1" version="1" check="all" comment="nodev on /var/tmp  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_tmp_partition_nodev_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_tmp_partition_nodev_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_tmp_partition_nodev_optional_exist:tst:1" version="1" check="all" comment="/var/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_tmp_partition_nodev_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_partition_nodev_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/tmp exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_tmp_partition_nodev_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_tmp_partition_noexec_optional:tst:1" version="2" check="all" comment="noexec on /var/tmp " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_tmp_partition_noexec_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_tmp_partition_noexec_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_partition_noexec_optional_in_fstab:tst:1" version="1" check="all" comment="noexec on /var/tmp  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_tmp_partition_noexec_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_tmp_partition_noexec_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_tmp_partition_noexec_optional_exist:tst:1" version="1" check="all" comment="/var/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_tmp_partition_noexec_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_partition_noexec_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/tmp exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_tmp_partition_noexec_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_tmp_partition_nosuid_optional:tst:1" version="2" check="all" comment="nosuid on /var/tmp " check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_tmp_partition_nosuid_optional:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_tmp_partition_nosuid_optional:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_partition_nosuid_optional_in_fstab:tst:1" version="1" check="all" comment="nosuid on /var/tmp  in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_tmp_partition_nosuid_optional_in_fstab:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_tmp_partition_nosuid_optional_in_fstab:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_var_tmp_partition_nosuid_optional_exist:tst:1" version="1" check="all" comment="/var/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_var_tmp_partition_nosuid_optional:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_var_tmp_partition_nosuid_optional_exist_in_fstab:tst:1" version="1" check="all" comment="/var/tmp exists in /etc/fstab" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_tmp_partition_nosuid_optional_in_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-test_package_aide_installed:tst:1" version="1" check="all" comment="package aide is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_aide_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" check="all" comment="package audispd-plugins is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_audit_installed:tst:1" version="1" check="all" comment="package audit is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_bind_removed:tst:1" version="1" check="all" comment="package bind is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_bind_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_chrony_installed:tst:1" version="1" check="all" comment="package chrony is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_cronie_installed:tst:1" version="1" check="all" comment="package cronie is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_cronie_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_crypto-policies_installed:tst:1" version="1" check="all" comment="package crypto-policies is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_crypto-policies_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_cryptsetup_installed:tst:1" version="1" check="all" comment="package cryptsetup is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_cryptsetup_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_cyrus-imapd_removed:tst:1" version="1" check="all" comment="package cyrus-imapd is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_cyrus-imapd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_dconf_installed:tst:1" version="1" check="all" comment="package dconf is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_dconf_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_dhcp_removed:tst:1" version="1" check="all" comment="package dhcp is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_dhcp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" check="all" comment="package dnf-automatic is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_dovecot_removed:tst:1" version="1" check="all" comment="package dovecot is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_dovecot_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" check="all" comment="package fapolicyd is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_fapolicyd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_firewalld_installed:tst:1" version="1" check="all" comment="package firewalld is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_firewalld_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_ftp_removed:tst:1" version="1" check="all" comment="package ftp is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_ftp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_gdm_installed:tst:1" version="1" check="all" comment="package gdm is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" check="all" comment="package gnutls-utils is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" check="all" comment="package gssproxy is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_gssproxy_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" check="all" comment="package inetutils-telnetd is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" check="all" comment="package iprutils is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_iprutils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" check="all" comment="package libreswan is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_libreswan_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" check="all" comment="package libselinux is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_libselinux_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_logrotate_installed:tst:1" version="1" check="all" comment="package logrotate is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_logrotate_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_McAfeeTP_installed:tst:1" version="1" check="all" comment="package McAfeeTP is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_McAfeeTP_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" check="all" comment="package net-snmp is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_net-snmp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" check="all" comment="package nfs-utils is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_nftables_installed:tst:1" version="1" check="all" comment="package nftables is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_nftables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_nis_removed:tst:1" version="1" check="all" comment="package nis is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_nis_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" check="all" comment="package nss-tools is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_nss-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_opensc_installed:tst:1" version="1" check="all" comment="package opensc is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_opensc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" check="all" comment="package openscap-scanner is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_openssh-clients_installed:tst:1" version="1" check="all" comment="package openssh-clients is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-clients_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" check="all" comment="package openssh-server is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" check="all" comment="package openssh-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" check="all" comment="package pcsc-lite is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_policycoreutils-python-utils_installed:tst:1" version="1" check="all" comment="package policycoreutils-python-utils is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_policycoreutils-python-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" check="all" comment="package policycoreutils is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_policycoreutils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_postfix_installed:tst:1" version="1" check="all" comment="package postfix is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_quagga_removed:tst:1" version="1" check="all" comment="package quagga is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_quagga_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_rear_installed:tst:1" version="1" check="all" comment="package rear is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_rear_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" check="all" comment="package rng-tools is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_rng-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_rsh-server_removed:tst:1" version="1" check="all" comment="package rsh-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_rsh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_rsh_removed:tst:1" version="1" check="all" comment="package rsh is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_rsh_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" check="all" comment="package rsyslog-gnutls is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" check="all" comment="package rsyslog is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_s-nail_installed:tst:1" version="1" check="all" comment="package s-nail is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_s-nail_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" check="all" comment="package scap-security-guide is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" check="all" comment="package sendmail is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_sendmail_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" check="all" comment="package setroubleshoot-plugins is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" check="all" comment="package setroubleshoot-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" check="all" comment="package setroubleshoot is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_squid_removed:tst:1" version="1" check="all" comment="package squid is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_squid_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_sssd_installed:tst:1" version="1" check="all" comment="package sssd is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_sssd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_sudo_installed:tst:1" version="1" check="all" comment="package sudo is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_syslog-ng_installed:tst:1" version="1" check="all" comment="package syslog-ng is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_syslog-ng_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_talk-server_removed:tst:1" version="1" check="all" comment="package talk-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_talk-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_talk_removed:tst:1" version="1" check="all" comment="package talk is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_talk_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_telnet-server_removed:tst:1" version="1" check="all" comment="package telnet-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_telnet-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_telnet_removed:tst:1" version="1" check="all" comment="package telnet is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_telnet_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" check="all" comment="package telnetd-ssl is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" check="all" comment="package telnetd is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_telnetd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_tftp-server_removed:tst:1" version="1" check="all" comment="package tftp-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_tftp-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_tftp_removed:tst:1" version="1" check="all" comment="package tftp is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_tftp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_tuned_removed:tst:1" version="1" check="all" comment="package tuned is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_tuned_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" check="all" comment="package usbguard is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" check="all" comment="package vsftpd is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_vsftpd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" check="all" comment="package xorg-x11-server-common is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:partition_test id="oval:ssg-testdev_shm_partition:tst:1" version="1" check="all" comment="/dev/shm on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mountdev_shm_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testhome_partition:tst:1" version="1" check="all" comment="/home on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mounthome_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testsrv_partition:tst:1" version="1" check="all" comment="/srv on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mountsrv_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testtmp_partition:tst:1" version="1" check="all" comment="/tmp on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mounttmp_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testvar_partition:tst:1" version="1" check="all" comment="/var on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mountvar_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testvar_log_partition:tst:1" version="1" check="all" comment="/var/log on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mountvar_log_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" check="all" comment="/var/log/audit on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mountvar_log_audit_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test id="oval:ssg-testvar_tmp_partition:tst:1" version="1" check="all" comment="/var/tmp on own partition" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mountvar_tmp_own_partition:obj:1"/>
        </linux:partition_test>
        <unix:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_0:tst:1" version="1" check="all" comment="Testing group ownership of /lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_1:tst:1" version="1" check="all" comment="Testing group ownership of /lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_2:tst:1" version="1" check="all" comment="Testing group ownership of /usr/lib/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_file_groupownerroot_permissions_syslibrary_files_3:tst:1" version="1" check="all" comment="Testing group ownership of /usr/lib64/" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" check="all" comment="System log files have appropriate groupowner set" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership_groupowner:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" check="all" comment="System log files have appropriate owner set" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership_owner:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" check="all" comment="System log files have appropriate permissions set" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions_permissions:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
        </unix:file_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_auditadm_exec_content:tst:1" version="1" check="all" comment="auditadm_exec_content is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_auditadm_exec_content:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_auditadm_exec_content:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_authlogin_nsswitch_use_ldap:tst:1" version="1" check="all" comment="authlogin_nsswitch_use_ldap is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_authlogin_nsswitch_use_ldap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_authlogin_nsswitch_use_ldap:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_authlogin_radius:tst:1" version="1" check="all" comment="authlogin_radius is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_authlogin_radius:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_authlogin_radius:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_deny_execmem:tst:1" version="1" check="all" comment="deny_execmem is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_deny_execmem:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_deny_execmem:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_kerberos_enabled:tst:1" version="1" check="all" comment="kerberos_enabled is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_kerberos_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_kerberos_enabled:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_polyinstantiation_enabled:tst:1" version="1" check="all" comment="polyinstantiation_enabled is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_polyinstantiation_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_polyinstantiation_enabled:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_secure_mode_insmod:tst:1" version="1" check="all" comment="secure_mode_insmod is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_secure_mode_insmod:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_secure_mode_insmod:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_selinuxuser_execheap:tst:1" version="1" check="all" comment="selinuxuser_execheap is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_selinuxuser_execheap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_selinuxuser_execheap:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_selinuxuser_execmod:tst:1" version="1" check="all" comment="selinuxuser_execmod is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_selinuxuser_execmod:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_selinuxuser_execmod:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_selinuxuser_execstack:tst:1" version="1" check="all" comment="selinuxuser_execstack is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_selinuxuser_execstack:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_selinuxuser_execstack:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:selinuxboolean_test id="oval:ssg-test_sebool_ssh_sysadm_login:tst:1" version="1" check="all" comment="ssh_sysadm_login is configured correctly" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_sebool_ssh_sysadm_login:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sebool_ssh_sysadm_login:ste:1"/>
        </linux:selinuxboolean_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_atd_disabled_atd:tst:1" version="1" check="all" comment="Test that the atd service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_atd_disabled_atd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_atd_disabled_atd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_atd_disabled_atd:tst:1" version="1" check="all" comment="Test that the property LoadState from the service atd is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_atd_disabled_atd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_atd_disabled_atd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_atd_disabled_test_service_atd_package_at_removed:tst:1" version="1" check="all" comment="package at is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_atd_disabled_test_service_atd_package_at_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_auditd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_auditd:tst:1" version="1" check="at least one" comment="Test that the auditd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_auditd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_auditd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" check="all" comment="package audit is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_autofs_disabled_autofs:tst:1" version="1" check="all" comment="Test that the autofs service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_autofs_disabled_autofs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_autofs_disabled_autofs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_autofs_disabled_autofs:tst:1" version="1" check="all" comment="Test that the property LoadState from the service autofs is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_autofs_disabled_autofs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_autofs_disabled_autofs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_autofs_disabled_test_service_autofs_package_autofs_removed:tst:1" version="1" check="all" comment="package autofs is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_autofs_disabled_test_service_autofs_package_autofs_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_avahi-daemon_disabled_avahi-daemon:tst:1" version="1" check="all" comment="Test that the avahi-daemon service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_avahi-daemon_disabled_avahi-daemon:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_avahi-daemon_disabled_avahi-daemon:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_avahi-daemon_disabled_avahi-daemon:tst:1" version="1" check="all" comment="Test that the property LoadState from the service avahi-daemon is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_avahi-daemon_disabled_avahi-daemon:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_avahi-daemon_disabled_avahi-daemon:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_avahi-daemon_disabled_test_service_avahi-daemon_package_avahi_removed:tst:1" version="1" check="all" comment="package avahi is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_avahi-daemon_disabled_test_service_avahi-daemon_package_avahi_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_chronyd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_chronyd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_chronyd:tst:1" version="1" check="at least one" comment="Test that the chronyd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_chronyd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_chronyd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" check="all" comment="package chrony is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_crond_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_crond_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_crond:tst:1" version="1" check="at least one" comment="Test that the crond service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_crond:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_crond:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" check="all" comment="package cronie is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_debug-shell_disabled_debug-shell:tst:1" version="1" check="all" comment="Test that the debug-shell service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_debug-shell_disabled_debug-shell:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_debug-shell_disabled_debug-shell:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_debug-shell_disabled_debug-shell:tst:1" version="1" check="all" comment="Test that the property LoadState from the service debug-shell is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_debug-shell_disabled_debug-shell:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_debug-shell_disabled_debug-shell:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_debug-shell_disabled_test_service_debug-shell_package_systemd_removed:tst:1" version="1" check="all" comment="package systemd is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_debug-shell_disabled_test_service_debug-shell_package_systemd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_fapolicyd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_fapolicyd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_fapolicyd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_fapolicyd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_fapolicyd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_fapolicyd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_fapolicyd:tst:1" version="1" check="at least one" comment="Test that the fapolicyd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_fapolicyd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_fapolicyd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_fapolicyd_package_fapolicyd_installed:tst:1" version="1" check="all" comment="package fapolicyd is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_fapolicyd_package_fapolicyd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_firewalld_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_firewalld_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_firewalld:tst:1" version="1" check="at least one" comment="Test that the firewalld service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_firewalld:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_firewalld:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" check="all" comment="package firewalld is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_iptables_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_iptables_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_iptables:tst:1" version="1" check="at least one" comment="Test that the iptables service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_iptables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_iptables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" check="all" comment="package iptables is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_kdump_disabled_kdump:tst:1" version="1" check="all" comment="Test that the kdump service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_kdump_disabled_kdump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_kdump_disabled_kdump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_kdump_disabled_kdump:tst:1" version="1" check="all" comment="Test that the property LoadState from the service kdump is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_kdump_disabled_kdump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_kdump_disabled_kdump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_kdump_disabled_test_service_kdump_package_kexec-tools_removed:tst:1" version="1" check="all" comment="package kexec-tools is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_kdump_disabled_test_service_kdump_package_kexec-tools_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_nftables_disabled_nftables:tst:1" version="1" check="all" comment="Test that the nftables service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_nftables_disabled_nftables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_nftables_disabled_nftables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_nftables_disabled_nftables:tst:1" version="1" check="all" comment="Test that the property LoadState from the service nftables is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_nftables_disabled_nftables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_nftables_disabled_nftables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_nftables_disabled_test_service_nftables_package_nftables_removed:tst:1" version="1" check="all" comment="package nftables is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_nftables_disabled_test_service_nftables_package_nftables_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_oddjobd_disabled_oddjobd:tst:1" version="1" check="all" comment="Test that the oddjobd service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_oddjobd_disabled_oddjobd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_oddjobd_disabled_oddjobd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_oddjobd_disabled_oddjobd:tst:1" version="1" check="all" comment="Test that the property LoadState from the service oddjobd is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_oddjobd_disabled_oddjobd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_oddjobd_disabled_oddjobd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_oddjobd_disabled_test_service_oddjobd_package_oddjob_removed:tst:1" version="1" check="all" comment="package oddjob is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_oddjobd_disabled_test_service_oddjobd_package_oddjob_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_pcscd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_pcscd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_pcscd:tst:1" version="1" check="at least one" comment="Test that the pcscd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_pcscd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_pcscd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" check="all" comment="package pcsc-lite is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_postfix:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_postfix_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_postfix_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_postfix_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_postfix_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_postfix_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_postfix:tst:1" version="1" check="at least one" comment="Test that the postfix service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_postfix:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_postfix:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_postfix_package_postfix_installed:tst:1" version="1" check="all" comment="package postfix is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_postfix_package_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_rdisc_disabled_rdisc:tst:1" version="1" check="all" comment="Test that the rdisc service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_rdisc_disabled_rdisc:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_rdisc_disabled_rdisc:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_rdisc_disabled_rdisc:tst:1" version="1" check="all" comment="Test that the property LoadState from the service rdisc is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_rdisc_disabled_rdisc:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_rdisc_disabled_rdisc:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_rdisc_disabled_test_service_rdisc_package_iputils_removed:tst:1" version="1" check="all" comment="package iputils is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_rdisc_disabled_test_service_rdisc_package_iputils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_rlogin_disabled_rlogin:tst:1" version="1" check="all" comment="Test that the rlogin service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_rlogin_disabled_rlogin:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_rlogin_disabled_rlogin:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_rlogin_disabled_rlogin:tst:1" version="1" check="all" comment="Test that the property LoadState from the service rlogin is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_rlogin_disabled_rlogin:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_rlogin_disabled_rlogin:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_rlogin_disabled_test_service_rlogin_package_rsh-server_removed:tst:1" version="1" check="all" comment="package rsh-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_rlogin_disabled_test_service_rlogin_package_rsh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rngd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rngd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_rngd:tst:1" version="1" check="at least one" comment="Test that the rngd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_rngd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_rngd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" check="all" comment="package rng-tools is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_rsyncd_disabled_rsyncd:tst:1" version="1" check="all" comment="Test that the rsyncd service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_rsyncd_disabled_rsyncd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_rsyncd_disabled_rsyncd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_rsyncd_disabled_rsyncd:tst:1" version="1" check="all" comment="Test that the property LoadState from the service rsyncd is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_rsyncd_disabled_rsyncd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_rsyncd_disabled_rsyncd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_rsyncd_disabled_test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" check="all" comment="package rsync-daemon is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_rsyncd_disabled_test_service_rsyncd_package_rsync-daemon_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rsyslog_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_rsyslog:tst:1" version="1" check="at least one" comment="Test that the rsyslog service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_rsyslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_rsyslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" check="all" comment="package rsyslog is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_snmpd_disabled_snmpd:tst:1" version="1" check="all" comment="Test that the snmpd service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_snmpd_disabled_snmpd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_snmpd_disabled_snmpd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_snmpd_disabled_snmpd:tst:1" version="1" check="all" comment="Test that the property LoadState from the service snmpd is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_snmpd_disabled_snmpd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_snmpd_disabled_snmpd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_snmpd_disabled_test_service_snmpd_package_net-snmp_removed:tst:1" version="1" check="all" comment="package net-snmp is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_snmpd_disabled_test_service_snmpd_package_net-snmp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_squid_disabled_squid:tst:1" version="1" check="all" comment="Test that the squid service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_squid_disabled_squid:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_squid_disabled_squid:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_squid_disabled_squid:tst:1" version="1" check="all" comment="Test that the property LoadState from the service squid is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_squid_disabled_squid:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_squid_disabled_squid:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_squid_disabled_test_service_squid_package_squid_removed:tst:1" version="1" check="all" comment="package squid is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_squid_disabled_test_service_squid_package_squid_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_sshd_disabled_sshd:tst:1" version="1" check="all" comment="Test that the sshd service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_sshd_disabled_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_sshd_disabled_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_sshd_disabled_sshd:tst:1" version="1" check="all" comment="Test that the property LoadState from the service sshd is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_sshd_disabled_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_sshd_disabled_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_sshd_disabled_test_service_sshd_package_openssh-server_removed:tst:1" version="1" check="all" comment="package openssh-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_sshd_disabled_test_service_sshd_package_openssh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_sshd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_sshd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_sshd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_sshd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_sshd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_sshd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_sshd:tst:1" version="1" check="at least one" comment="Test that the sshd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_sshd_package_openssh-server_installed:tst:1" version="1" check="all" comment="package openssh-server is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_sshd_package_openssh-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_sssd:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_sssd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_sssd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_sssd_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_sssd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_sssd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_sssd:tst:1" version="1" check="at least one" comment="Test that the sssd service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_sssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_sssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_sssd_package_sssd-common_installed:tst:1" version="1" check="all" comment="package sssd-common is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_sssd_package_sssd-common_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_syslog-ng:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_syslog-ng_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_syslog-ng_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_syslog-ng_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_syslog-ng_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_syslog-ng_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_syslog-ng:tst:1" version="1" check="at least one" comment="Test that the syslog-ng service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_syslog-ng:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_syslog-ng:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_syslog-ng_package_syslog-ng_installed:tst:1" version="1" check="all" comment="package syslog-ng is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_syslog-ng_package_syslog-ng_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_socket_loadstate_is_masked_systemd-coredump:tst:1" version="1" check="all" comment="Test that the property LoadState from the systemd-coredump.socket is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_socket_loadstate_is_masked_systemd-coredump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_socket_loadstate_is_masked_systemd-coredump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_systemd-journald:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_systemd-journald_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_systemd-journald_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_systemd-journald_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_systemd-journald_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_systemd-journald_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_systemd-journald:tst:1" version="1" check="at least one" comment="Test that the systemd-journald service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_systemd-journald:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_systemd-journald:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_systemd-journald_package_systemd_installed:tst:1" version="1" check="all" comment="package systemd is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_systemd-journald_package_systemd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_telnet_disabled_telnet:tst:1" version="1" check="all" comment="Test that the telnet service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_telnet_disabled_telnet:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_telnet_disabled_telnet:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_telnet_disabled_telnet:tst:1" version="1" check="all" comment="Test that the property LoadState from the service telnet is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_telnet_disabled_telnet:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_telnet_disabled_telnet:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_telnet_disabled_test_service_telnet_package_telnet-server_removed:tst:1" version="1" check="all" comment="package telnet-server is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_telnet_disabled_test_service_telnet_package_telnet-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ufw:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ufw_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ufw_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ufw_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ufw_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ufw_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ufw:tst:1" version="1" check="at least one" comment="Test that the ufw service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_ufw:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ufw:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_ufw_package_ufw_installed:tst:1" version="1" check="all" comment="package ufw is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_ufw_package_ufw_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_usbguard_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_usbguard_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_usbguard:tst:1" version="1" check="at least one" comment="Test that the usbguard service is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_running_usbguard:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_usbguard:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" check="all" comment="package usbguard is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_set_firewalld_default_zone:tst:1" version="1" check="all" comment="tests the presence of 'DefaultZone=drop' setting in the /etc/firewalld/firewalld.conf file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_set_firewalld_default_zone:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_allow_only_protocol2_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of Protocol setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_allow_only_protocol2_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_allow_only_protocol2_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" check="all" comment="tests the value of Protocol setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_allow_only_protocol2:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_allow_only_protocol2:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_Protocol_present_sshd_allow_only_protocol2:tst:1" version="1" check="all" comment="Verify that the value of Protocol is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_allow_only_protocol2:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_compression_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of Compression setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_compression_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_compression_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_compression:tst:1" version="1" check="all" comment="tests the value of Compression setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_compression:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_compression:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_Compression_present_sshd_disable_compression:tst:1" version="1" check="all" comment="Verify that the value of Compression is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_compression:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PermitEmptyPasswords setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_empty_passwords_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" check="all" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_empty_passwords:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PermitEmptyPasswords_present_sshd_disable_empty_passwords:tst:1" version="1" check="all" comment="Verify that the value of PermitEmptyPasswords is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_empty_passwords:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of GSSAPIAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_GSSAPIAuthentication_present_sshd_disable_gssapi_auth:tst:1" version="1" check="all" comment="Verify that the value of GSSAPIAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_gssapi_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of KerberosAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_kerb_auth_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" check="all" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_kerb_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_KerberosAuthentication_present_sshd_disable_kerb_auth:tst:1" version="1" check="all" comment="Verify that the value of KerberosAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_kerb_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_pubkey_auth_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PubkeyAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PubkeyAuthentication_present_sshd_disable_pubkey_auth:tst:1" version="1" check="all" comment="Verify that the value of PubkeyAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_pubkey_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of IgnoreRhosts setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" check="all" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_IgnoreRhosts_present_sshd_disable_rhosts:tst:1" version="1" check="all" comment="Verify that the value of IgnoreRhosts is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_rhosts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_rsa_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of RhostsRSAAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts_rsa_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" check="all" comment="tests the value of RhostsRSAAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts_rsa:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_RhostsRSAAuthentication_present_sshd_disable_rhosts_rsa:tst:1" version="1" check="all" comment="Verify that the value of RhostsRSAAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_rhosts_rsa:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_login_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PermitRootLogin setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_login_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_login_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_login:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_login:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PermitRootLogin_present_sshd_disable_root_login:tst:1" version="1" check="all" comment="Verify that the value of PermitRootLogin is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_root_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PermitRootLogin setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_password_login_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_password_login:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PermitRootLogin_present_sshd_disable_root_password_login:tst:1" version="1" check="all" comment="Verify that the value of PermitRootLogin is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_root_password_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_tcp_forwarding_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of AllowTcpForwarding setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" check="all" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_AllowTcpForwarding_present_sshd_disable_tcp_forwarding:tst:1" version="1" check="all" comment="Verify that the value of AllowTcpForwarding is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_tcp_forwarding:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_user_known_hosts_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of IgnoreUserKnownHosts setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" check="all" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_IgnoreUserKnownHosts_present_sshd_disable_user_known_hosts:tst:1" version="1" check="all" comment="Verify that the value of IgnoreUserKnownHosts is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_user_known_hosts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of X11Forwarding setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_X11Forwarding_present_sshd_disable_x11_forwarding:tst:1" version="1" check="all" comment="Verify that the value of X11Forwarding is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_disable_x11_forwarding:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PermitUserEnvironment setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" check="all" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PermitUserEnvironment_present_sshd_do_not_permit_user_env:tst:1" version="1" check="all" comment="Verify that the value of PermitUserEnvironment is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_do_not_permit_user_env:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_gssapi_auth_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of GSSAPIAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_GSSAPIAuthentication_present_sshd_enable_gssapi_auth:tst:1" version="1" check="all" comment="Verify that the value of GSSAPIAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_gssapi_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_pam_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of UsePAM setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pam_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pam_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_pam:tst:1" version="1" check="all" comment="tests the value of UsePAM setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pam:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pam:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_UsePAM_present_sshd_enable_pam:tst:1" version="1" check="all" comment="Verify that the value of UsePAM is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_pam:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_pubkey_auth_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PubkeyAuthentication setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pubkey_auth_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pubkey_auth_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_pubkey_auth:tst:1" version="1" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_pubkey_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_pubkey_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PubkeyAuthentication_present_sshd_enable_pubkey_auth:tst:1" version="1" check="all" comment="Verify that the value of PubkeyAuthentication is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_pubkey_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of StrictModes setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_strictmodes_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" check="all" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_strictmodes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_StrictModes_present_sshd_enable_strictmodes:tst:1" version="1" check="all" comment="Verify that the value of StrictModes is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_strictmodes:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of Banner setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_Banner_present_sshd_enable_warning_banner:tst:1" version="1" check="all" comment="Verify that the value of Banner is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_warning_banner:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_net_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of Banner setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_net_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_net_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_net:tst:1" version="1" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_net:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_net:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_Banner_present_sshd_enable_warning_banner_net:tst:1" version="1" check="all" comment="Verify that the value of Banner is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_warning_banner_net:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_x11_forwarding_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of X11Forwarding setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_X11Forwarding_present_sshd_enable_x11_forwarding:tst:1" version="1" check="all" comment="Verify that the value of X11Forwarding is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_enable_x11_forwarding:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" check="all" comment="tests the presence of 'Include /etc/ssh/sshd_config.d/*.conf' setting in the /etc/ssh/sshd_config file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_includes_config_files:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of PrintLastLog setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_print_last_log_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log:tst:1" version="1" check="all" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_print_last_log:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_PrintLastLog_present_sshd_print_last_log:tst:1" version="1" check="all" comment="Verify that the value of PrintLastLog is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_print_last_log:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of ClientAliveCountMax setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive:tst:1" version="1" check="all" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive:tst:1" version="1" check="all" comment="Verify that the value of ClientAliveCountMax is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_keepalive:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_0_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of ClientAliveCountMax setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_0_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_0_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" check="all" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ClientAliveCountMax_present_sshd_set_keepalive_0:tst:1" version="1" check="all" comment="Verify that the value of ClientAliveCountMax is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_keepalive_0:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of LogLevel setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_info_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_info:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_LogLevel_present_sshd_set_loglevel_info:tst:1" version="1" check="all" comment="Verify that the value of LogLevel is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_loglevel_info:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of LogLevel setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_LogLevel_present_sshd_set_loglevel_verbose:tst:1" version="1" check="all" comment="Verify that the value of LogLevel is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_set_loglevel_verbose:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_use_priv_separation_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of UsePrivilegeSeparation setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_use_priv_separation_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_use_priv_separation_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" check="all" comment="tests the value of UsePrivilegeSeparation setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_use_priv_separation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_use_priv_separation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_UsePrivilegeSeparation_present_sshd_use_priv_separation:tst:1" version="1" check="all" comment="Verify that the value of UsePrivilegeSeparation is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_use_priv_separation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost_sshd_included_files:tst:1" version="1" check="all" comment="tests the value of X11UseLocalhost setting in the sshd_config included file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_sshd_included_files:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_x11_use_localhost_sshd_included_files:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" check="all" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config file" check_existence="any_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_x11_use_localhost:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_X11UseLocalhost_present_sshd_x11_use_localhost:tst:1" version="1" check="all" comment="Verify that the value of X11UseLocalhost is present" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_collection_obj_sshd_x11_use_localhost:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" check="all" comment="tests the presence of '\[certmap\/.+\/.+\]' setting in the /etc/sssd/sssd.conf file" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_certmap:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_sudoers:tst:1" version="1" check="all" comment="noexec exists in /etc/sudoers or /etc/sudoers.d/" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_noexec_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_requiretty_sudoers:tst:1" version="1" check="all" comment="requiretty exists in /etc/sudoers or /etc/sudoers.d/" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_requiretty_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_use_pty_sudoers:tst:1" version="1" check="all" comment="use_pty exists in /etc/sudoers or /etc/sudoers.d/" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_use_pty_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_logfile_sudoers:tst:1" version="1" check="all" comment="logfile exists in /etc/sudoers or /etc/sudoers.d/" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_logfile_sudoers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_logfile_sudoers:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_fs_protected_fifos_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter fs.protected_fifos set to 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_fifos_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_fifos_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_fifos_static_user_missing:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_fifos:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_fifos_static_user:tst:1" version="1" check="all" comment="fs.protected_fifos static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_fifos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_fifos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_fifos_static_pkg_correct:tst:1" version="2" check="all" comment="fs.protected_fifos static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_fifos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_fifos:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_fs_protected_hardlinks_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter fs.protected_hardlinks set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_hardlinks_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_hardlinks_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_hardlinks_static_user_missing:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_hardlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_hardlinks_static_user:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_hardlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_hardlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_hardlinks_static_pkg_correct:tst:1" version="2" check="all" comment="fs.protected_hardlinks static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_hardlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_hardlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_fs_protected_regular_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter fs.protected_regular set to 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_regular_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_regular_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_regular_static_user_missing:tst:1" version="1" check="all" comment="fs.protected_regular static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_regular:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_regular_static_user:tst:1" version="1" check="all" comment="fs.protected_regular static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_regular:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_regular:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_regular_static_pkg_correct:tst:1" version="2" check="all" comment="fs.protected_regular static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_regular:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_regular:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_fs_protected_symlinks_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter fs.protected_symlinks set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_fs_protected_symlinks_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_fs_protected_symlinks_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_symlinks_static_user_missing:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_symlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_symlinks_static_user:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_protected_symlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_symlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_protected_symlinks_static_pkg_correct:tst:1" version="2" check="all" comment="fs.protected_symlinks static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_symlinks:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_protected_symlinks:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_fs_suid_dumpable_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter fs.suid_dumpable set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_fs_suid_dumpable_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_fs_suid_dumpable_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_suid_dumpable_static_user_missing:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_suid_dumpable:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_suid_dumpable_static_user:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_fs_suid_dumpable:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_suid_dumpable:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_fs_suid_dumpable_static_pkg_correct:tst:1" version="2" check="all" comment="fs.suid_dumpable static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_suid_dumpable:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_fs_suid_dumpable:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_core_pattern_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_core_pattern_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_core_pattern_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_pattern_static_user_missing:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_core_pattern:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_pattern_static_user:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_core_pattern:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_pattern_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.core_pattern static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_core_pattern:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_core_uses_pid_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.core_uses_pid set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_core_uses_pid_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_core_uses_pid_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_uses_pid_static_user_missing:tst:1" version="1" check="all" comment="kernel.core_uses_pid static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_core_uses_pid:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_uses_pid_static_user:tst:1" version="1" check="all" comment="kernel.core_uses_pid static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_core_uses_pid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_uses_pid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_core_uses_pid_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.core_uses_pid static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_core_uses_pid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_core_uses_pid:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_dmesg_restrict_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_dmesg_restrict_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_dmesg_restrict_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user_missing:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_dmesg_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_dmesg_restrict_static_user:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_dmesg_restrict_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.dmesg_restrict static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_dmesg_restrict:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_kexec_load_disabled_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_kexec_load_disabled_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_static_user_missing:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_kexec_load_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_static_user:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_kexec_load_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_kexec_load_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_kexec_load_disabled_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.kexec_load_disabled static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_kexec_load_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_kexec_load_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_kptr_restrict_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.kptr_restrict set to 1 or 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_kptr_restrict_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_kptr_restrict_runtime_1:ste:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_kptr_restrict_runtime_2:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_kptr_restrict_static_user_missing:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_kptr_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_kptr_restrict_static_user:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_kptr_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_kptr_restrict_1:ste:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_kptr_restrict_2:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_kptr_restrict_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.kptr_restrict static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_kptr_restrict:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_kptr_restrict_1:ste:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_kptr_restrict_2:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_modules_disabled_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.modules_disabled set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_modules_disabled_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_modules_disabled_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_modules_disabled_static_user_missing:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_modules_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_modules_disabled_static_user:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_modules_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_modules_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_modules_disabled_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.modules_disabled static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_modules_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_modules_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_panic_on_oops_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.panic_on_oops set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_panic_on_oops_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_panic_on_oops_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_panic_on_oops_static_user_missing:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_panic_on_oops:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_panic_on_oops_static_user:tst:1" version="1" check="all" comment="kernel.panic_on_oops static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_panic_on_oops_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.panic_on_oops static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_panic_on_oops:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_panic_on_oops:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_cpu_time_max_percent_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_static_user_missing:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_static_user:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_perf_cpu_time_max_percent:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_cpu_time_max_percent_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_perf_cpu_time_max_percent:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_event_max_sample_rate_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_static_user_missing:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_static_user:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_perf_event_max_sample_rate:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_event_max_sample_rate_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_perf_event_max_sample_rate:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_perf_event_paranoid_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_perf_event_paranoid_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_static_user_missing:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_perf_event_paranoid:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_static_user:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_perf_event_paranoid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_perf_event_paranoid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_perf_event_paranoid_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.perf_event_paranoid static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_perf_event_paranoid:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_perf_event_paranoid:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_pid_max_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.pid_max set to 65536" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_pid_max_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_pid_max_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_pid_max_static_user_missing:tst:1" version="1" check="all" comment="kernel.pid_max static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_pid_max:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_pid_max_static_user:tst:1" version="1" check="all" comment="kernel.pid_max static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_pid_max:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_pid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_pid_max_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.pid_max static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_pid_max:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_pid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_randomize_va_space_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.randomize_va_space set to 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_randomize_va_space_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_randomize_va_space_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_randomize_va_space_static_user_missing:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_randomize_va_space:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_randomize_va_space_static_user:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_randomize_va_space:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_randomize_va_space:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_randomize_va_space_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.randomize_va_space static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_randomize_va_space:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_sysrq_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.sysrq set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_sysrq_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_sysrq_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_sysrq_static_user_missing:tst:1" version="1" check="all" comment="kernel.sysrq static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_sysrq:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_sysrq_static_user:tst:1" version="1" check="all" comment="kernel.sysrq static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_sysrq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_sysrq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_sysrq_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.sysrq static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_sysrq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_sysrq:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_unprivileged_bpf_disabled_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_static_user_missing:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_static_user:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1 or 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime_1:ste:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime_2:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_user_missing:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_user:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default_1:ste:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default_2:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_pkg_not_wrong:tst:1" version="2" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /usr/lib/sysctl.d/*.conf" check_existence="any_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default_1:ste:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default_2:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_yama_ptrace_scope_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_yama_ptrace_scope_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user_missing:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_yama_ptrace_scope:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_user:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_kernel_yama_ptrace_scope:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_yama_ptrace_scope:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_kernel_yama_ptrace_scope_static_pkg_correct:tst:1" version="2" check="all" comment="kernel.yama.ptrace_scope static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_kernel_yama_ptrace_scope:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_core_bpf_jit_harden_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_core_bpf_jit_harden_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_static_user_missing:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_core_bpf_jit_harden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_static_user:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_core_bpf_jit_harden:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_core_bpf_jit_harden:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_core_bpf_jit_harden_static_pkg_correct:tst:1" version="2" check="all" comment="net.core.bpf_jit_harden static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_core_bpf_jit_harden:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_core_bpf_jit_harden:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_local set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_local_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_local:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_local static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_local:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_local:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_local_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.accept_local static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_local:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_source_route_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.arp_filter set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_arp_filter_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_arp_filter:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_filter static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_arp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_arp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_filter_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.arp_filter static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_arp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.arp_ignore set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_arp_ignore_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_arp_ignore:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_arp_ignore_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.arp_ignore static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.drop_gratuitous_arp set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.drop_gratuitous_arp static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.forwarding set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_forwarding_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_forwarding_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.forwarding static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_forwarding:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.forwarding static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_forwarding_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.forwarding static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_log_martians_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.route_localnet set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_route_localnet_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_route_localnet:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.route_localnet static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_route_localnet:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_route_localnet:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_route_localnet_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.route_localnet static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_route_localnet:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1 or 2" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_rp_filter_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_runtime_1:ste:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_runtime_2:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_rp_filter_1:ste:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_rp_filter_2:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_rp_filter_1:ste:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_rp_filter_2:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_secure_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_send_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.all.shared_media set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_shared_media_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_shared_media:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.all.shared_media static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_all_shared_media_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.all.shared_media static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_source_route_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_log_martians_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_rp_filter_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_secure_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_send_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_send_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.conf.default.shared_media set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_shared_media_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_shared_media:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_static_user:tst:1" version="1" check="all" comment="net.ipv4.conf.default.shared_media static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_conf_default_shared_media_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.conf.default.shared_media static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_shared_media:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_user:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_user:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_ip_forward_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_ip_forward_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_forward_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_ip_forward_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_ip_forward:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_ip_forward_static_user:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_ip_forward:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_ip_forward:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_ip_forward_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.ip_forward static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_ip_forward:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_ip_forward:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_ip_local_port_range_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_local_port_range_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_static_user:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_ip_local_port_range:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_ip_local_port_range_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.ip_local_port_range static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_ip_local_port_range:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.tcp_rfc1337 set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_tcp_rfc1337_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_tcp_rfc1337_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.tcp_rfc1337 static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_tcp_rfc1337:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_static_user:tst:1" version="1" check="all" comment="net.ipv4.tcp_rfc1337 static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_tcp_rfc1337:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_tcp_rfc1337:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_tcp_rfc1337_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.tcp_rfc1337 static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_tcp_rfc1337:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_tcp_syncookies_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user_missing:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_user:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv4_tcp_syncookies_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv4.tcp_syncookies static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.accept_ra static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_defrtr_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_pinfo_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_source_route_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_source_route_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_source_route static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_source_route:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_source_route static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_autoconf_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_autoconf_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_autoconf_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_forwarding_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_forwarding_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.forwarding static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_forwarding:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.forwarding static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.forwarding static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_max_addresses_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_max_addresses_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_max_addresses_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_router_solicitations_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_router_solicitations_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_all_router_solicitations_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_defrtr_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_pinfo_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_redirects_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_source_route_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_source_route_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_source_route static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_source_route:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_source_route static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.accept_source_route static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_autoconf_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_autoconf_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_autoconf_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_disable_ipv6_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_disable_ipv6_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_max_addresses_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_max_addresses_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_max_addresses_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_router_solicitations_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_router_solicitations_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_static_user_missing:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_static_user:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_net_ipv6_conf_default_router_solicitations_static_pkg_correct:tst:1" version="2" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_user_max_user_namespaces_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter user.max_user_namespaces set to 0" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_user_max_user_namespaces_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_user_max_user_namespaces_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_user_max_user_namespaces_static_user_missing:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_user_max_user_namespaces:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_user_max_user_namespaces_static_user:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_user_max_user_namespaces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_user_max_user_namespaces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_user_max_user_namespaces_static_pkg_correct:tst:1" version="2" check="all" comment="user.max_user_namespaces static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_user_max_user_namespaces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_user_max_user_namespaces:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_sysctl_vm_mmap_min_addr_runtime:tst:1" version="1" check="all" comment="kernel runtime parameter vm.mmap_min_addr set to 65536" check_existence="all_exist" state_operator="OR">
          <unix:object object_ref="oval:ssg-object_sysctl_vm_mmap_min_addr_runtime:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_vm_mmap_min_addr_runtime:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_vm_mmap_min_addr_static_user_missing:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_vm_mmap_min_addr:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_vm_mmap_min_addr_static_user:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_user_sysctl_vm_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_vm_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sysctl_vm_mmap_min_addr_static_pkg_correct:tst:1" version="2" check="all" comment="vm.mmap_min_addr static configuration in /usr/lib/sysctl.d/*.conf" check_existence="all_exist" state_operator="OR">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_sysctl_vm_mmap_min_addr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_sysctl_vm_mmap_min_addr:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_tmp:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_tmp_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_tmp_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_mount_running_tmp:tst:1" version="1" check="at least one" comment="Test that the tmp mount is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_mount_running_tmp:obj:1"/>
          <linux:state state_ref="oval:ssg-state_mount_running_tmp:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_dnf-automatic_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" check="at least one" comment="Test that the dnf-automatic timer is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_timer_running_dnf-automatic:obj:1"/>
          <linux:state state_ref="oval:ssg-state_timer_running_dnf-automatic:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_logrotate:tst:1" version="1" check="all" comment="systemd test" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_logrotate_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_logrotate_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_timer_running_logrotate:tst:1" version="1" check="at least one" comment="Test that the logrotate timer is running" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_timer_running_logrotate:obj:1"/>
          <linux:state state_ref="oval:ssg-state_timer_running_logrotate:ste:1"/>
        </linux:systemdunitproperty_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" check="all" comment="audit auditctl" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" check="all" comment="audit augenrules" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_audit_rules_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit setdomainname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit setdomainname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit setdomainname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit setdomainname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit sethostname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit sethostname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit sethostname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit sethostname" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_file_not_set:tst:1" version="1" check="all" comment="log_file not set" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_file:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" check="all" comment="log_group = root" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" check="all" comment="log_group is set" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_is_set:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_kernel_installed:tst:1" version="1" check="all" comment="package kernel is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_kernel_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_rpm_ostree_installed:tst:1" version="1" check="all" comment="package rpm-ostree is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_rpm_ostree_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_bootc_installed:tst:1" version="1" check="all" comment="package bootc is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_bootc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_openshift_kubelet_removed:tst:1" version="1" check="all" comment="package openshift-kubelet is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_openshift_kubelet_removed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" check="all" comment="Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_bootloader_disable_recovery_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_bootloader_disable_recovery_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" check="all" comment="Ensure more than one chronyd NTP server is set" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_chronyd_multiple_servers:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 7" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 8" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_ol9_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 9" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_ol9_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol9_system:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_unix_family:tst:1" version="1" check="all" comment="Test installed OS is part of the unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rhcos:tst:1" version="1" check="all" comment="os-release is rhcos" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" comment="rhcoreos is version 4" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test id="oval:ssg-test_rhel8:tst:1" version="1" check="all" comment="redhat-release is version 8" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 8" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test id="oval:ssg-test_rhel9:tst:1" version="1" check="all" comment="redhat-release is version 9" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel9:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 9" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-test_rhvh4_version:tst:1" version="1" check="all" comment="redhat-release-virtualization-host RPM package is installed" check_existence="only_one_exists" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" comment="sled-release is version 6" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" comment="sles-release is version 6" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 12" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" comment="sled-release is version 15" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" comment="sles-release is version 15" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 15" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_suma_4:tst:1" version="1" check="all" comment="SUMA is version 4" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_suma_4:obj:1"/>
          <linux:state state_ref="oval:ssg-state_suma_4:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_sle_hpc:tst:1" version="1" check="all" comment="SLE HPC release is version 15" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_sle_hpc:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle_hpc:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_slmicro5_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_slmicro5_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_slmicro5_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test id="oval:ssg-test_slmicroos5:tst:1" version="1" check="all" comment="sle-micro-release is version 5" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_slmicroos5:obj:1"/>
          <linux:state state_ref="oval:ssg-state_slmicroos5:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_slmicro5:tst:1" version="1" check="all" comment="sle-micro-release is version 5" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_slmicro5:obj:1"/>
          <linux:state state_ref="oval:ssg-state_slmicro5:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test id="oval:ssg-test_lsb:tst:1" version="1" check="all" comment="/etc/lsb-release exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_lsb:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" comment="Check Ubuntu" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" comment="Check Ubuntu version" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" comment="Check Ubuntu version" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" comment="Check Ubuntu version" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" check="all" comment="'CD/DVD drive is not listed in /etc/fstab" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" check="all" comment="Check if expected removable partitions truly exist on the system" check_existence="none_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
        </unix:file_test>
        <ind:variable_test id="oval:ssg-test_sshd_not_required:tst:1" version="1" check="all" comment="Verify if Profile set Value sshd_required as not required" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_not_required:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_not_required:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_sshd_required:tst:1" version="1" check="all" comment="Verify if Profile set Value sshd_required as required" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_required:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_required:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" check="all" comment="Verify if Value of sshd_required is the default" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_sshd_requirement_unknown:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_requirement_unset:ste:1"/>
        </ind:variable_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" check="all" comment="64 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_aarch_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_aarch_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" check="all" comment="64 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" comment="64 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" check="all" comment="64 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_s390_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_s390_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" check="all" comment="32 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
        </unix:uname_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" check="all" comment="64 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
        </unix:uname_test>
        <ind:textfilecontent54_test id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" check="all" comment="Check the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non whitespace character and exists" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_usbguard_rules_nonempty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" check="all" comment="Verify the existence of var_accounts_user_umask_as_number variable" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" check="all" comment="Check if removable partition variable value represents CD/DVD drive" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
        </ind:variable_test>
      </oval-def:tests>
      <oval-def:objects>
        <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_augen_immutable_login_uids:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*--loginuid-immutable\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditctl_immutable_login_uids:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\s*--loginuid-immutable\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules_usr_share:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/usr/share/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl_usr_share:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/usr/share/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sudoers_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sudoers_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sudoers_d_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/?[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sudoers_d_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/?[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_uid_privileged_function_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_uid_privileged_function_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_uid_privileged_function_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_uid_privileged_function_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_gid_privileged_function_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_gid_privileged_function_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_gid_privileged_function_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_gid_privileged_function_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ars_shutdown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-f\s+(\d)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ars_shutdown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-f\s+(\d)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_group_ownership_default_var_log_audit_directories:obj:1" version="1" comment="/var/log/audit directories">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_group_owner_not_root_var_log_audit_directories:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_group_ownership_var_log_audit_directories-non_root:obj:1" version="1" comment="/var/log/audit directories">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_group_owner_not_root_var_log_audit_directories-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_group_ownership_var_log_audit_directories:obj:1" version="1" comment="log directories">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals" var_ref="oval:ssg-audit_log_dir_group_ownership:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_group_owner_not_root_var_log_audit_directories:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_directory_ownership_var_log_audit_file:obj:1" version="1" comment="audit log files">
          <unix:filepath operation="pattern match" var_ref="oval:ssg-audit_log_file_path:var:1"/>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_user_ownership_var_log_audit_path:obj:1" version="1" comment="log_file's directory">
          <unix:path operation="equals" var_ref="oval:ssg-var_directory_ownership_var_log_audit_path:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit_directories:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_user_ownership_var_log_audit_directories:obj:1" version="1" comment="/var/log/audit directories">
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit_directories:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_audit_log_directory:obj:1" version="1" comment="audit log files">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals" var_ref="oval:ssg-audit_log_dir:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0700:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_var_log_audit_directory:obj:1" version="1" comment="/var/log/audit files">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0700:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_var_log_audit_directory-non_root:obj:1" version="1" comment="/var/log/audit files">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0750:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_audit_log_directory-non_root:obj:1" version="1" comment="audit log files">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals" var_ref="oval:ssg-audit_log_dir:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0750:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_group_ownership_audit_log_files:obj:1" version="1" comment="audit log files">
          <unix:filepath operation="equals" var_ref="oval:ssg-audit_log_file_path:var:1"/>
          <oval-def:filter action="include">oval:ssg-state_group_owner_not_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_group_ownership_default_audit_log_files:obj:1" version="1" comment="/var/log/audit files">
          <unix:filepath operation="equals">/var/log/audit/audit.log</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_group_owner_not_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1" comment="/var/log/audit directories">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1" comment="/var/log/audit files">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1" comment="/var/log/audit directories">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1" comment="/var/log/audit files">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_audit_log_files:obj:1" version="1" comment="/var/log/audit files">
          <unix:filepath operation="pattern match" var_ref="oval:ssg-audit_log_file_path:var:1"/>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0600:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_audit_default_log_files:obj:1" version="1" comment="/var/log/audit/audit.log files">
          <unix:filepath operation="equals">/var/log/audit/audit.log</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0600:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295))\s+(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_audit_rules_privileged_commands_exec_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">^(?!/proc(/.*|$)).*$</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_audit_rules_privileged_commands_dev_partitons:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_audit_rules_privileged_commands_nosuid_partitons:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_audit_rules_privileged_commands_noexec_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_audit_rules_privileged_commands:obj:1" version="1" comment="Files with setuid or setgid permission in file systems that allow their execution">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="defined" max_depth="-1"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_audit_rules_privileged_commands_exec_mountpoints:var:1"/>
          <unix:filename operation="pattern match">^\w+</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_dracut_tmp_files:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_audit_rules_privileged_commands_bootc:obj:1" version="1" comment="Files with setuid or setgid permission in file systems that allow their execution">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="defined" max_depth="-1"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^\w+</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_dracut_tmp_files:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_audit_rules_privileged_commands_sysroot:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_audit_rules_privileged_commands_priv_cmds_count:obj:1" version="1" comment="Number of all privileged commands in the system, regardless of audit rules.">
          <ind:var_ref>oval:ssg-var_audit_rules_privileged_commands_priv_cmds_count:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_audit_rules_privileged_commands_priv_cmds_count_bootc:obj:1" version="1" comment="Number of all privileged commands in the system, regardless of audit rules.">
          <ind:var_ref>oval:ssg-var_audit_rules_privileged_commands_priv_cmds_count_bootc:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_priv_cmds_from_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rules_privileged_commands_rule_regex:var:1"/>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_unprivileged_commands:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_priv_cmds_from_augenrules_bootc:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rules_privileged_commands_rule_regex:var:1"/>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_unprivileged_commands_bootc:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_priv_cmds_from_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rules_privileged_commands_rule_regex:var:1"/>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_unprivileged_commands:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
          <ind:filepath>/etc/audit/plugins.d/syslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_error_action:obj:1" version="3">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_error_action_stig:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_full_action:obj:1" version="3">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_full_action_stig:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action_stig:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_name_format:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_overflow_action:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)overflow_action(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fapolicy_default_deny_policy_compiled_rules:obj:1" version="1">
          <ind:filepath>/etc/fapolicyd/compiled.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\s*deny\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fapolicy_default_deny_policy_fapolicyd_rules:obj:1" version="2">
          <ind:filepath>/etc/fapolicyd/fapolicyd.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\s*deny\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fapolicy_default_deny_permissive_mode:obj:1" version="2">
          <ind:filepath>/etc/fapolicyd/fapolicyd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*permissive\s*=\s*(\d+)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_root_mail_alias:obj:1" version="1">
          <ind:filepath operation="equals">/etc/aliases</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_postmaster_mail_alias:obj:1" version="1">
          <ind:filepath operation="equals">/etc/aliases</ind:filepath>
          <ind:pattern operation="pattern match">^(?i)postmaster\s*:\s*(.+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_postfix_network_listening_disabled:obj:1" version="1" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly">
          <ind:filepath>/etc/postfix/main.cf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*inet_interfaces[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_postfix_prevent_unrestricted_relay:obj:1" version="1">
          <ind:filepath>/etc/postfix/main.cf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*smtpd_client_restrictions = (.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_postfix_prevent_unrestricted_relay_config_file:obj:1" version="1" comment="The configuration file /etc/postfix/main.cf for postfix_prevent_unrestricted_relay">
          <unix:filepath operation="pattern match">^/etc/postfix/main.cf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_use_kerberos_security_all_exports:obj:1" version="2">
          <ind:filepath>/etc/exports</ind:filepath>
          <ind:pattern operation="pattern match">^\/.*\((\S+)\)$</ind:pattern>
          <ind:instance datatype="int" operation="not equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_non_empty_exports_file:obj:1" version="1">
          <ind:filepath>/etc/exports</ind:filepath>
          <ind:pattern operation="pattern match">^\/.*$</ind:pattern>
          <ind:instance datatype="int" operation="not equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_port_value:obj:1" version="1">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*port[\s]+(\S+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_chrony_remote_server_configuration:obj:1" version="1" comment="Ensure at least one NTP server is set">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-temp_variable_test_servers:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_chrony_remote_pool_configuration:obj:1" version="1" comment="Ensure at least one NTP pool is set">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-temp_variable_test_pools:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_cmdport_value:obj:1" version="1">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*cmdport[\s]+(\S+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_set_maxpoll:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_set_maxpoll:obj:1" version="1">
          <ind:filepath operation="pattern match">^(/etc/chrony\.conf|/etc/chrony\.d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:server|pool|peer)[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1" version="1">
          <ind:filepath operation="pattern match">^(/etc/chrony\.conf|/etc/chrony\.d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:server|pool|peer)[\s]+[\S]+[\s]+(.*)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_override:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/sysconfig/chronyd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*OPTIONS=.*[\s'"]-u(?!\s*chrony\b).*</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_chronyd_server_directive:obj:1" version="1" comment="Matches server entries in Chrony conf files">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*server.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_chronyd_no_pool_directive:obj:1" version="1" comment="Matches pool entires in Chrony conf files">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+pool.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_chronyd_remote_server:obj:1" version="1" comment="Ensure at least one NTP server is set">
          <ind:filepath operation="pattern match">^(/etc/chrony.conf|/etc/chrony.d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?:server|pool)[\s]+.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:obj:1" version="1">
          <ind:filepath>/etc/nsswitch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*group:\s+(.*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_chrony_keys:obj:1" version="1" comment="/etc/chrony.keys">
          <unix:filepath>/etc/chrony.keys</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_chrony_keys_uid_chrony:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_chrony_keys_gid_chrony:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupowner_etc_chrony_keys_etc_group:obj:1" version="1" comment="gid of the dedicated chrony group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^chrony:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_chrony_keys_with_usrlib:obj:1" version="1" comment="/etc/chrony.keys">
          <unix:filepath>/etc/chrony.keys</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_chrony_keys_uid_chrony:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_chrony_keys_gid_chrony_with_usrlib:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupowner_etc_chrony_keys_etc_group_with_usrlib:obj:1" version="1" comment="gid of the dedicated chrony group">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_file_groupowner_etc_chrony_keys_etc_group:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_file_groupowner_etc_chrony_keys_usr_lib_group:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupowner_etc_chrony_keys_usr_lib_group:obj:1" version="1">
          <ind:filepath>/usr/lib/group</ind:filepath>
          <ind:pattern operation="pattern match">^chrony:\w+:(\w+):.*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1" comment="Ensure more than one ntpd NTP server is set">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_no_shosts_equiv_files_root:obj:1" version="1" comment="look for any shosts.equiv file on the system">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="equals">shosts.equiv</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1" comment="look for .rhosts in /root">
          <unix:path operation="equals">/root</unix:path>
          <unix:filename operation="pattern match">^\.rhosts$</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1" comment="look for .rhosts in /home">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename operation="pattern match">^\.rhosts$</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1" comment="look for /etc/hosts.equiv">
          <unix:path operation="equals">/etc</unix:path>
          <unix:filename operation="pattern match">^hosts\.equiv$</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_no_shosts_files_root:obj:1" version="1" comment="look for any .shosts file on the system">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="equals">.shosts</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_tftpd_uses_secure_mode:obj:1" version="1">
          <ind:filepath>/etc/xinetd.d/tftp</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*server_args[\s]+=[\s]+.*?-s[\s]+([/\.\w]+).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
          <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_offending_keys:obj:1" version="1" comment="All keys in /etc/ssh with unsafe ownership/permission combination">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">.*_key$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__sshd_private_key:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-filter_ssh_key_owner_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-filter_ssh_key_owner_ssh_keys:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_group_gid:obj:1" version="1" comment="gid of the dedicated ssh key group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^ssh_keys:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ssh_client_rekey_limit_main_config:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*RekeyLimit.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ssh_client_rekey_limit_include_configs:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/ssh/ssh_config\.d/.*\.conf$</ind:filepath>
          <ind:pattern var_ref="oval:ssg-ssh_client_line_regex:var:1" operation="pattern match"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_sshd_port_enabled_zone_files_usr:obj:1" version="1">
          <ind:path>/usr/lib/firewalld/zones</ind:path>
          <ind:filename operation="pattern match" var_check="all" var_ref="oval:ssg-var_firewalld_sshd_port_enabled_default_zones:var:1"/>
          <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
        </ind:xmlfilecontent_object>
        <unix:file_object id="oval:ssg-object_firewalld_sshd_port_enabled_customized_zone_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path>/etc/firewalld/zones</unix:path>
          <unix:filename operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_firewalld_sshd_port_enabled_default_zones:var:1"/>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_sshd_port_enabled_zone_files_etc:obj:1" version="1">
          <ind:path>/etc/firewalld/zones</ind:path>
          <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
          <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
        </ind:xmlfilecontent_object>
        <unix:file_object id="oval:ssg-object_firewalld_sshd_port_enabled_custom_zone_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="local"/>
          <unix:path>/etc/firewalld/zones</unix:path>
          <unix:filename operation="pattern match">^.*\.xml$</unix:filename>
        </unix:file_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_sshd_port_enabled_ssh_service_file_usr:obj:1" version="1">
          <ind:filepath>/usr/lib/firewalld/services/ssh.xml</ind:filepath>
          <ind:xpath>/service/port[@port='22']</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:textfilecontent54_object id="oval:ssg-object_firewalld_sshd_port_enabled_ssh_service_file_etc:obj:1" version="1">
          <ind:filepath>/etc/firewalld/services/ssh.xml</ind:filepath>
          <ind:pattern operation="pattern match">&lt;port.*port="(\d+)"</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_crypto_policy_include_sshd_drop_in:obj:1" version="1">
          <ind:filepath operation="pattern match">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Include(?-i)[ \t]+/etc/ssh/sshd_config\.d/\*.conf$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_crypto_policy_include_sshd_include_system_crypto:obj:1" version="1">
          <ind:filepath operation="pattern match">/etc/ssh/(sshd_config|sshd_config\.d/.*\.conf)</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Include(?-i)[ \t]+/etc/crypto-policies/back-ends/opensshserver\.config$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_allow_user:obj:1" version="1">
          <ind:filepath operation="pattern match">^\/etc\/ssh\/sshd_config.*$</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^[ ]*AllowUsers[ ]+((?:[^ \n]+[ ]*)+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_allow_group:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/ssh/sshd_config.*$</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^[ ]*AllowGroups[ ]+((?:[^ \n]+[ ]*)+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_deny_user:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/ssh/sshd_config.*$</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^[ ]*DenyUsers[ ]+((?:[^ \n]+[ ]*)+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_deny_group:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/ssh/sshd_config.*$</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^[ ]*DenyGroups[ ]+((?:[^ \n]+[ ]*)+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*RekeyLimit[\s]+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_idle_timeout:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_sshd_idle_timeout:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_login_grace_time:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_login_grace_time:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_sshd_login_grace_time:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_max_auth_tries:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_max_auth_tries:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_sshd_max_auth_tries:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_max_sessions:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_max_sessions:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_sshd_max_sessions:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1" version="2">
          <ind:path operation="pattern match">/etc/(ssh|ssh/sshd_config.d)</ind:path>
          <ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1" version="2">
          <ind:path operation="pattern match">/etc/(ssh|ssh/sshd_config.d)</ind:path>
          <ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1" version="2">
          <ind:path operation="pattern match">/etc/(ssh|ssh/sshd_config.d)</ind:path>
          <ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)match(?-i)\s+\S+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_sshd_use_strong_macs:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_sshd_config_strong_macs:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_strong_macs:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_certificate_verification:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[sssd](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*ocsp_dgst=(\w+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_pam_services:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*services[ \t]*=[ \t]*(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards:obj:1" version="2">
          <ind:filepath operation="pattern match">/etc/sssd/(sssd\.conf|conf.d/[^/]+\.conf)</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(\w+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards_smartcard_auth_options:obj:1" version="2">
          <ind:filepath>/etc/pam.d/smartcard-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth.*?pam_sss\.so(.*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards_system_auth_options:obj:1" version="2">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth.*?pam_sss\.so(.*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_offline_cred_expiration:obj:1" version="1">
          <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*(\d+)\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_cache_credentials:obj:1" version="1">
          <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*cache_credentials\s*=\s*(\w+)\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sssd_ldap_tls_reqcert:obj:1" version="2">
          <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*](?:[^\n\[\]]*\n+)+?[\s]*ldap_tls_reqcert[ \t]*=[ \t]*(\w+)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_use_starttls_sssd_conf:obj:1" version="2">
          <ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*](?:[^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ \t]*=[ \t]*((?i)\w+)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_usbguard_auditbackend:obj:1" version="1">
          <ind:filepath>/etc/usbguard/usbguard-daemon.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*AuditBackend=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1" version="1" comment="The configuration file /etc/usbguard/usbguard-daemon.conf for configure_usbguard_auditbackend">
          <unix:filepath operation="pattern match">^/etc/usbguard/usbguard-daemon.conf</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_package_xorg-x11-server-Xorg_removed:obj:1" version="1">
          <linux:name>xorg-x11-server-Xorg</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_package_xorg-x11-server-utils_removed:obj:1" version="1">
          <linux:name>xorg-x11-server-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_package_xorg-x11-server-Xwayland_removed:obj:1" version="1">
          <linux:name>xorg-x11-server-Xwayland</linux:name>
        </linux:rpminfo_object>
        <unix:symlink_object id="oval:ssg-object_disable_xwindows_runlevel_target:obj:1" version="1" comment="default.target systemd softlink exists">
          <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object id="oval:ssg-object_pam_fingerprint_symlinked_to_authselect:obj:1" version="1" comment="see the test comment">
          <unix:filepath>/etc/pam.d/fingerprint-auth</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object id="oval:ssg-object_pam_password_symlinked_to_authselect:obj:1" version="1" comment="see the test comment">
          <unix:filepath>/etc/pam.d/password-auth</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object id="oval:ssg-object_pam_postlogin_symlinked_to_authselect:obj:1" version="1" comment="see the test comment">
          <unix:filepath>/etc/pam.d/postlogin</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object id="oval:ssg-object_pam_smartcard_symlinked_to_authselect:obj:1" version="1" comment="see the test comment">
          <unix:filepath>/etc/pam.d/smartcard-auth</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object id="oval:ssg-object_pam_system_symlinked_to_authselect:obj:1" version="1" comment="see the test comment">
          <unix:filepath>/etc/pam.d/system-auth</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath operation="pattern match">^/etc/issue(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_issue_net:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath operation="pattern match">^/etc/issue\.net$</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_banner_etc_motd_exists:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_motd:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/motd</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen\]([^\n]*\n+)+?banner-message-enable=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-enable$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-text$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^banner-message-text=[\s]*'*(.*?)'$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disallow_bypass_password_sudo:obj:1" version="1">
          <ind:filepath>/etc/pam.d/sudo</ind:filepath>
          <ind:pattern operation="pattern match">^.*pam_succeed_if.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="2">
          <ind:filepath>/etc/pam.d/postlogin</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+.*\s+pam_lastlog\.so\b(?!.*\ssilent\s).*\sshowfailed\s.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_pam_faillock_password_auth_pam_unix_auth:obj:1" version="1" comment="Get all occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*auth\N+pam_unix\.so</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_pam_faillock_password_auth_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_password_auth_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_pam_faillock_password_auth_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_password_auth_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_pam_faillock_system_auth_pam_unix_auth:obj:1" version="1" comment="Get all occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*auth\N+pam_unix\.so</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_pam_faillock_system_auth_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_system_auth_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_pam_faillock_system_auth_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_system_auth_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_account_password_selinux_faillock_dir_collector:obj:1" version="1">
          <ind:filepath operation="pattern match">/etc/pam.d/password-auth|/etc/pam.d/system-auth|/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(?:auth.*pam_faillock\.so.*)?dir\s*=\s*(\S+)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:selinuxsecuritycontext_object id="oval:ssg-object_account_password_selinux_faillock_dir:obj:1" version="1" comment="SELinux context information from pam_faillock.so tally directories">
          <linux:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_account_password_selinux_faillock_dir_collector:var:1"/>
          <linux:filename xsi:nil="true"/>
        </linux:selinuxsecuritycontext_object>
        <ind:variable_object id="oval:ssg-object_account_password_selinux_faillock_dir_not_set:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_account_password_selinux_faillock_dir_collector:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_account_pam_faillock_audit_parameter_system_auth:obj:1" version="1" comment="Get the pam_faillock.so preauth audit parameter from system-auth file">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_account_pam_faillock_audit_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_account_pam_faillock_audit_parameter_password_auth:obj:1" version="1" comment="Get the pam_faillock.so preauth audit parameter from system-auth file">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_account_pam_faillock_audit_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_account_pam_faillock_audit_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so audit parameter in /etc/security/faillock.conf">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*audit</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-var_accounts_password_pam_pwhistory_remember_password_auth_module_regex:var:1" var_check="at least one" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern var_check="at least one" operation="pattern match" var_ref="oval:ssg-var_accounts_password_pam_pwhistory_remember_password_auth_pam_param_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_param_conf:obj:1" version="1" comment="Collect the pam_pwhistory.so remember parameter from /etc/security/pwhistory.conf">
          <ind:filepath operation="pattern match">^/etc/security/pwhistory.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_password_pam_pwhistory_remember_password_auth_conf_param_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-var_accounts_password_pam_pwhistory_remember_system_auth_module_regex:var:1" var_check="at least one" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern var_check="at least one" operation="pattern match" var_ref="oval:ssg-var_accounts_password_pam_pwhistory_remember_system_auth_pam_param_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_param_conf:obj:1" version="1" comment="Collect the pam_pwhistory.so remember parameter from /etc/security/pwhistory.conf">
          <ind:filepath operation="pattern match">^/etc/security/pwhistory.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_password_pam_pwhistory_remember_system_auth_conf_param_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-var_accounts_password_pam_unix_remember_module_regex:var:1" var_check="at least one" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember_pamd:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern var_check="at least one" operation="pattern match" var_ref="oval:ssg-var_accounts_password_pam_unix_remember_pam_param_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember_param_conf:obj:1" version="1" comment="Collect the pam_pwhistory.so remember parameter from /etc/security/pwhistory.conf">
          <ind:filepath operation="pattern match">^/etc/security/pwhistory.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_password_pam_unix_remember_conf_param_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember_legacy:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required)|(?:\[.*\]))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_pam_faillock_audit_parameter_system_auth:obj:1" version="1" comment="Get the pam_faillock.so preauth audit parameter from system-auth file">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_audit_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_pam_faillock_audit_parameter_password_auth:obj:1" version="1" comment="Get the pam_faillock.so preauth audit parameter from system-auth file">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_audit_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_audit_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so audit parameter in /etc/security/faillock.conf">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*audit</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_unix_auth:obj:1" version="1" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_system_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_auth:obj:1" version="1" comment="Check common definition of pam_faillock.so in auth section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_password_pam_faillock_account:obj:1" version="1" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_system:obj:1" version="1" comment="Get the pam_faillock.so even_deny_root parameter from system-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_pamd_password:obj:1" version="1" comment="Get the pam_faillock.so even_deny_root parameter from password-auth file">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_root_parameter_faillock_conf:obj:1" version="1" comment="Try to get the even_deny_root parameter from /etc/security/faillock.conf">
          <ind:filepath operation="pattern match">^/etc/security/faillock.conf$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_pam_faillock_dir_parameter_system_auth:obj:1" version="1" comment="Get the pam_faillock.so preauth dir parameter from system-auth file">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_dir_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="include">oval:ssg-state_pam_faillock_dir_parameter_not_default_value:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_pam_faillock_dir_parameter_password_auth:obj:1" version="1" comment="Get the pam_faillock.so preauth dir parameter from system-auth file">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_pam_faillock_dir_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="include">oval:ssg-state_pam_faillock_dir_parameter_not_default_value:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_pam_faillock_dir_parameter_system_auth:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_faillock_dir_set_both_preauth_authfail_system_auth:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-obj_pam_faillock_dir_parameter_password_auth:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_faillock_dir_set_both_preauth_authfail_password_auth:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_dir_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so dir parameter in /etc/security/faillock.conf">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_faillock_conf_dir_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_enforce_for_root:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^enforce_for_root$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwquality_password_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwquality_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^password[\s]*requisite[\s]*pam_pwquality\.so</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_password_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1" version="1">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*retry[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_set_password_hashing_algorithm_libuserconf:obj:1" version="2" comment="only one hashing algorithm option for pam_unix.so is found in /etc/libuser.conf">
          <ind:filepath>/etc/libuser.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*crypt_style[\s]*=[\s]*(\w*)[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_set_password_hashing_algorithm_logindefs:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_set_password_hashing_algorithm_passwordauth:obj:1" version="1" comment="only one hashing algorithm option for pam_unix.so is found in /etc/pam.d/password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+(?!.*(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt).*(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)).*(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_unix_hashing_algorithm_systemauth:obj:1" version="1" comment="only one hashing algorithm option for pam_unix.so is found in /etc/pam.d/system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+(?!.*\b(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)\b[^#]*\b(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)\b)[^#]*\b(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_login_defs_sha_crypt_min_rounds_default:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^\s*SHA_CRYPT_MIN_ROUNDS\s*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_login_defs_sha_crypt_min_rounds_present:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^\s*SHA_CRYPT_MIN_ROUNDS\s+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_login_defs_sha_crypt_max_rounds_default:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^\s*SHA_CRYPT_MAX_ROUNDS\s*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_login_defs_sha_crypt_max_rounds_present:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^\s*SHA_CRYPT_MAX_ROUNDS\s+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_password_hashing_min_rounds_login_defs_le_5000:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_password_hashing_min_rounds_login_defs:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_ctrlaltdel_burstaction:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/systemd/system.conf(\.d/.*\.conf)?$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*CtrlAltDelBurstAction[\s]*=[\s]*none$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:symlink_object id="oval:ssg-object_disable_ctrlaltdel_exists:obj:1" version="1" comment="Disable Ctrl-Alt-Del key sequence override exists">
          <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?:.*\s)?systemd\.confirm_spawn(?:=(?:1|yes|true|on))?(?:\s.*)?"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd\.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_logind_session_timeout:obj:1" version="1">
          <ind:filepath>/etc/systemd/logind.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Login\].*(?:\n\s*[^[\s].*)*\n^\s*StopIdleSessionSec[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_logind_session_timeout_config_file:obj:1" version="1" comment="The configuration file /etc/systemd/logind.conf for logind_session_timeout">
          <unix:filepath operation="pattern match">^/etc/systemd/logind.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_emergency_service:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/emergency.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_emergency_service_emergency:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/emergency.target</ind:filepath>
          <ind:pattern operation="pattern match">^Requires=.*emergency\.service</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_no_custom_emergency_service:obj:1" version="1" comment="look for emergency.service in /etc/systemd/system">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^emergency.service$</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_no_custom_emergency_target:obj:1" version="1" comment="look for emergency.target in /etc/systemd/system">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^emergency.target$</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_require_emergency_target_auth_drop_in_config_exist:obj:1" version="1" comment="Look for drop in config files for emergency.service">
          <unix:path operation="equals">/etc/systemd/system/emergency.service.d</unix:path>
          <unix:filename operation="pattern match">^.*\.conf$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_distro:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/rescue.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStart\s?=\s?\-?(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_override:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:path>/etc/systemd/system/rescue.service.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^.*ExecStart\s?=\s+.*ExecStart\s?=\s?\-?(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_opensc_card_drivers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/opensc.*\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+card_drivers[\s]+=[\s]+(\S+);$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-obj_all_uids:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
        </unix:password_object>
        <ind:variable_object id="oval:ssg-obj_count_of_all_uids:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_uids:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_authorized_local_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([a-zA-Z0-9_.-]+?):</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_default_os_user:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_all_group_ids:obj:1" version="1" comment="Get all group ids">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^.+:.+:(\d+):.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_count_of_all_group_ids:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_group_ids:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_auth_inactive:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^auth\s*(?:required|requisite)\s*pam_lastlog\.so[^#]*inactive=(\d+)[\s\S]*^\s*auth\s*sufficient\s*pam_unix\.so</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_system_auth_inactive:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^auth\s*(?:required|requisite)\s*pam_lastlog\.so[^#]*inactive=(\d+)[\s\S]*^\s*auth\s*sufficient\s*pam_unix\.so</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
          <ind:filepath>/etc/default/useradd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){2}(\d+):(?:[^:]*:){3}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){2}(\d+):(?:[^:]*:){3}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_set_max_life_existing_shadow_password_users_max_life_not_existing:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]+:)(?:[^:]*:){2}():(?:[^:]*:){3}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:shadow_object id="oval:ssg-object_accounts_password_set_max_life_root:obj:1" version="1">
          <unix:username operation="equals">root</unix:username>
        </unix:shadow_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_accounts_password_set_min_life_existing_password_max_life_existing:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:)(\d+):(?:[^:]*:){4}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:)(\d+):(?:[^:]*:){4}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_set_min_life_existing_shadow_password_users_max_life_not_existing:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]+:)(?:[^:]*:)():(?:[^:]*:){4}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_accounts_password_set_warn_age_existing:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){3}(\d+):(?:[^:]*:){2}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_set_warn_age_existing_no_pass:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){3}(\d+):(?:[^:]*:){2}(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_accounts_set_post_pw_existing:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){4}(\d+):(?:[^:]*:)(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_set_post_pw_existing_no_pass:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[^:]*:)(?:[^\!\*:]*:)(?:[^:]*:){4}(\d+):(?:[^:]*:)(?:[^:]*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
        </unix:password_object>
        <unix:shadow_object id="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_has_locked_password:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1</oval-def:filter>
        </unix:shadow_object>
        <unix:shadow_object id="oval:ssg-object_accounts_password_last_change_is_in_past:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_chage_past_has_no_password:ste:1</oval-def:filter>
        </unix:shadow_object>
        <ind:variable_object id="oval:ssg-object_accounts_password_last_change_is_in_past_time_diff:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_password_last_change_is_in_past_time_diff:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_password_auth_pam_unix_rounds:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_system_auth_pam_unix_rounds:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]+:([0-9]+):</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]+:[0-9]+:([0-9]+):</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/(system|password)-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*\bnullok\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+::.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_no_netrc_files_home:obj:1" version="1" comment="look for .netrc in /home">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename operation="pattern match">^\.netrc$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_root_gid_zero:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^root:.+:\d+:(\d+).+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ensure_pam_wheel_group_exists:obj:1" version="1" comment="locate the line referring the group used in pam_wheel.so module">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_ensure_pam_wheel_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_root_password_etc_shadow:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^root:\$(y|[0-9].+)\$.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_securetty_exists:obj:1" version="1" comment="/etc/securetty file exists">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_direct_root_logins:obj:1" version="1" comment="no entries /etc/securetty">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_no_password_auth_for_systemaccounts_objects:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
          <oval-def:filter action="include">oval:ssg-state_no_password_auth_for_systemaccounts_users_uids:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_no_password_auth_for_systemaccounts_users_ignored:ste:1</oval-def:filter>
        </unix:password_object>
        <unix:shadow_object id="oval:ssg-object_no_password_auth_for_systemaccounts:obj:1" version="1">
          <unix:username var_ref="oval:ssg-var_no_password_auth_for_systemaccounts_usernames:var:1" var_check="at least one"/>
          <oval-def:filter action="exclude">oval:ssg-filter_no_password_auth_for_systemaccounts_no_passwords_or_locked_accounts:ste:1</oval-def:filter>
        </unix:shadow_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*(?:^|\n)\s*(UID_MIN[\s]+[\d]+)\s*(?:$|\n)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*(?:^|\n)\s*(SYS_UID_MIN[\s]+[\d]+)\s*(?:$|\n)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*(?:^|\n)\s*(SYS_UID_MAX[\s]+[\d]+)\s*(?:$|\n)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1" comment="serial ports /etc/securetty">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1" comment="virtual consoles /etc/securetty">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_use_pam_wheel_for_su:obj:1" version="1" comment="collect pam_wheel.so line in /etc/pam.d/su if use_uid option is present in the line">
          <ind:filepath>/etc/pam.d/su</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+\buse_uid\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_use_pam_wheel_group_for_su:obj:1" version="1" comment="check /etc/pam.d/su for correct setting">
          <ind:filepath>/etc/pam.d/su</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+required\s+pam_wheel\.so\s+(?=[^#]*\buse_uid\b)[^#]*\bgroup=([_a-z][-0-9_a-z]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1" version="2">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)CREATE_HOME(?-i)[\s]+yes[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_logon_fail_delay:obj:1" version="1" comment="FAIL_DELAY value from /etc/login.defs">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
          <ind:filepath>/etc/security/limits.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_tmp_inst:obj:1" version="1">
          <unix:path>/tmp/tmp-inst</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_tmp_in_namespace_conf:obj:1" version="1">
          <ind:filepath>/etc/security/namespace.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_var_tmp_tmp_inst:obj:1" version="1">
          <unix:path>/var/tmp/tmp-inst</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1" version="1">
          <ind:filepath>/etc/security/namespace.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="3">
          <ind:filepath>/etc/profile</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?:typeset|declare)[\s]+-xr[\s]+TMOUT=([\w$]+).*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="3">
          <ind:path>/etc/profile.d</ind:path>
          <ind:filename operation="pattern match">^.*\.sh$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*(?:typeset|declare)[\s]+-xr[\s]+TMOUT=([\w$]+).*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_tmout_all_tmout_instances:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_etc_profile_tmout:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_etc_profiled_tmout:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_accounts_tmout_defined:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_tmout_instances:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_group_ownership_home_dirs:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_user_dot_group_ownership_home_dirs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_group_ownership_home_dirs_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_user_dot_group_ownership_home_dirs_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_group_ownership_gids:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_user_dot_group_ownership_gids_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_group_ownership_gids_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_user_dot_group_ownership_gids_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_accounts_user_dot_group_ownership_init_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="local"/>
          <unix:path var_ref="oval:ssg-var_accounts_user_dot_group_ownership_dirs:var:1" var_check="at least one"/>
          <unix:filename operation="pattern match">^\..*</unix:filename>
        </unix:file_object>
        <unix:password_object id="oval:ssg-object_accounts_user_dot_no_world_writable_programs_objects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_accounts_user_dot_no_world_writable_programs_objects_others:obj:1</oval-def:object_reference>
          </oval-def:set>
        </unix:password_object>
        <unix:password_object id="oval:ssg-object_accounts_user_dot_no_world_writable_programs_objects_others:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
          <oval-def:filter action="include">oval:ssg-state_accounts_user_dot_no_world_writable_programs_users_uids:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_user_dot_no_world_writable_programs_users_ignored:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_user_dot_no_world_writable_programs_users_nologin_shell:ste:1</oval-def:filter>
        </unix:password_object>
        <unix:file_object id="oval:ssg-object_world_writable_programs:obj:1" version="2">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="defined"/>
          <unix:path>/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_world_writable_programs:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_no_world_writable_programs_init_files:obj:1" version="3">
          <ind:path var_ref="oval:ssg-var_accounts_user_dot_no_world_writable_programs_dirs:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match" var_ref="oval:ssg-var_user_initialization_files_regex:var:1"/>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_world_writable_programs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_user_ownership_home_dirs:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_user_dot_user_ownership_home_dirs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_user_ownership_home_dirs_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_user_dot_user_ownership_home_dirs_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_user_ownership_uids:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_user_dot_user_ownership_uids_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_dot_user_ownership_uids_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_user_dot_user_ownership_uids_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_accounts_user_dot_user_ownership_init_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="local"/>
          <unix:path var_ref="oval:ssg-var_accounts_user_dot_user_ownership_dirs:var:1" var_check="at least one"/>
          <unix:filename operation="pattern match">^\..*</unix:filename>
        </unix:file_object>
        <unix:password_object id="oval:ssg-object_accounts_user_interactive_home_directory_defined_objects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_accounts_user_interactive_home_directory_defined_objects_others:obj:1</oval-def:object_reference>
          </oval-def:set>
        </unix:password_object>
        <unix:password_object id="oval:ssg-object_accounts_user_interactive_home_directory_defined_objects_others:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
          <oval-def:filter action="include">oval:ssg-state_accounts_user_interactive_home_directory_defined_users_uids:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_user_interactive_home_directory_defined_users_ignored:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_user_interactive_home_directory_defined_users_nologin_shell:ste:1</oval-def:filter>
        </unix:password_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_interactive_home_directory_exists_objects:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_user_interactive_home_directory_exists_objects_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_user_interactive_home_directory_exists_objects_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_user_interactive_home_directory_exists_objects_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_fs:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_list:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_count_fs:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count_fs:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_count_pw:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_groupownership_home_dirs:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_users_home_files_groupownership_home_dirs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_groupownership_home_dirs_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_users_home_files_groupownership_home_dirs_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_groupownership_gids:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_users_home_files_groupownership_gids_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_groupownership_gids_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_users_home_files_groupownership_gids_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_accounts_users_home_files_groupownership_dirs:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path var_ref="oval:ssg-var_accounts_users_home_files_groupownership_dirs:var:1" var_check="at least one"/>
          <unix:filename operation="pattern match">.*</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_ownership_home_dirs:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_users_home_files_ownership_home_dirs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_ownership_home_dirs_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_users_home_files_ownership_home_dirs_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_ownership_uids:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_users_home_files_ownership_uids_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_ownership_uids_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_users_home_files_ownership_uids_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_accounts_users_home_files_ownership_dirs:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path var_ref="oval:ssg-var_accounts_users_home_files_ownership_dirs:var:1" var_check="at least one"/>
          <unix:filename operation="pattern match">.*</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_permissions_home_dirs:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_users_home_files_permissions_home_dirs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_users_home_files_permissions_home_dirs_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_users_home_files_permissions_home_dirs_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_accounts_users_home_files_permissions_dirs:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path var_ref="oval:ssg-var_accounts_users_home_files_permissions_dirs:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_accounts_users_home_files_permissions_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path var_ref="oval:ssg-var_accounts_users_home_files_permissions_dirs:var:1" var_check="at least one"/>
          <unix:filename operation="pattern match">^[^\.].*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_users_home_files_permissions_is_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupownership_home_directories_home_dirs:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_file_groupownership_home_directories_home_dirs_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupownership_home_directories_home_dirs_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_file_groupownership_home_directories_home_dirs_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupownership_home_directories_gids:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_file_groupownership_home_directories_gids_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_groupownership_home_directories_gids_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_file_groupownership_home_directories_gids_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownership_home_directories_dirs:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_file_groupownership_home_directories_dirs:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permission_user_init_files:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_file_permission_user_init_files_home_dirs:var:1" var_check="at least one"/>
          <unix:filename operation="pattern match" var_ref="oval:ssg-var_user_initialization_files_regex:var:1"/>
        </unix:file_object>
        <unix:password_object id="oval:ssg-object_file_permission_user_init_files_objects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_file_permission_user_init_files_objects_others:obj:1</oval-def:object_reference>
          </oval-def:set>
        </unix:password_object>
        <unix:password_object id="oval:ssg-object_file_permission_user_init_files_objects_others:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
          <oval-def:filter action="include">oval:ssg-state_file_permission_user_init_files_users_uids:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permission_user_init_files_users_ignored:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permission_user_init_files_users_nologin_shell:ste:1</oval-def:filter>
        </unix:password_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_permissions_home_directories_objects:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_file_permissions_home_directories_objects_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_permissions_home_directories_objects_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_file_permissions_home_directories_objects_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_permissions_home_directories_dirs:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_file_permissions_home_directories_dirs:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:password_object id="oval:ssg-object_file_permissions_home_dirs_objects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_file_permissions_home_dirs_objects_others:obj:1</oval-def:object_reference>
          </oval-def:set>
        </unix:password_object>
        <unix:password_object id="oval:ssg-object_file_permissions_home_dirs_objects_others:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_home_dirs_users_uids:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_home_dirs_users_ignored:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_home_dirs_users_nologin_shell:ste:1</oval-def:filter>
        </unix:password_object>
        <unix:file_object id="oval:ssg-object_file_permissions_home_dirs_dirs:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_file_permissions_home_dirs_dirs:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>PATH</ind:name>
        </ind:environmentvariable58_object>
        <unix:file_object id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1" comment="root's path directories with wrong group / other write permissions">
          <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>PATH</ind:name>
        </ind:environmentvariable58_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_bashrc:obj:1" version="1" comment="Umask value from /etc/bashrc">
          <ind:filepath>/etc/bashrc</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*\bumask\s+(\d{3})\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_bashrc:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_bashrc_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1" version="1" comment="Umask value from /etc/csh.cshrc">
          <ind:filepath>/etc/csh.cshrc</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_csh_cshrc:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" version="1" comment="Umask value from /etc/login.defs">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*UMASK[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" version="1" comment="umask value retrieved from profile configuration files">
          <ind:filepath operation="pattern match">^\/etc\/profile(?:\.d\/.*\.sh|\.d\/sh\.local)?$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_umask_interactive_users_objects:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-variable_object_accounts_umask_interactive_users_objects_regex:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_umask_interactive_users_objects_local_interactive_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_object_accounts_umask_interactive_users_objects_users_ignored:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_umask_interactive_users:obj:1" version="1" comment="Umask value from initialization files">
          <ind:behaviors max_depth="0" recurse_direction="down"/>
          <ind:path var_ref="oval:ssg-var_accounts_umask_interactive_users_dirs:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^\..*</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*umask\s*</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_umask_interactive_users_bash_history:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_user_accounts:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
        </unix:password_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_unique_superuser:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_password_usercfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/user.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_usercfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/user.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEFAULT_MMAP_MIN_ADDR="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_default_mmap_min_addr_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_kernel_config_default_mmap_min_addr_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_default_mmap_min_addr_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_x86_64:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_rainer:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?m)^\s*cron\.\*\s+action\(\s*.*(?i)\btype\b(?-i)="omfile"\s*.*(?i)\bfile\b(?-i)="/var/log/cron"\s*.*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir_rainer:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">(?m)^\s*cron\.\*\s+action\(\s*.*(?i)\btype\b(?-i)="omfile"\s*.*(?i)\bfile\b(?-i)="/var/log/cron"\s*.*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_logging_all_facilities:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?m)^[\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/messages"\s*\))\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir_logging_all_facilities:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">(?m)^[\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/messages"\s*\))\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1" version="1" comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_rainer:obj:1" version="1" comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using RainerScript">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverAuthMode\b(?-i)="x509/name".*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1" version="1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir_rainer:obj:1" version="1" comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using RainerScript">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverAuthMode\b(?-i)="x509/name".*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1" version="1" comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_rainer:obj:1" version="1" comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using RainerScript">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverMode\b(?-i)="1".*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1" version="1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir_rainer:obj:1" version="1" comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using RainerScript">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverMode\b(?-i)="1".*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1" version="1" comment="Check if  $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_rainer:obj:1" version="1" comment="Check if DefaultNetstreamDriver is set to gtls in /etc/rsyslog.conf using RainerScript">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*global\(.*(?i)\bDefaultNetStreamDriver\b(?-i)="gtls".*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1" version="1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir_rainer:obj:1" version="1" comment="Check if DefaultNetstreamDriver is set to gtls in files in /etc/rsyslog.d using RainerScript">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*global\(.*(?i)\bDefaultNetStreamDriver\b(?-i)="gtls".*\)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_auth:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*auth\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*authpriv\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_daemon:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*daemon\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
          <ind:filepath>/etc/logrotate.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*daily[\s#]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1" version="2">
          <ind:filepath>/etc/logrotate.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(weekly|monthly|yearly)[\s#]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
          <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_logrotate_enabled_systemd_target:obj:1" version="1" comment="look for logrotate.timer in /etc/systemd/system/multi-user.target.wants and /etc/systemd/system/timers.target.wants">
          <unix:filepath operation="pattern match">^/etc/systemd/system/(multi-user|timers)\.target\.wants/logrotate\.timer$</unix:filepath>
          <oval-def:filter action="include">oval:ssg-unit_logrotate_state_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten_legacy:obj:1" version="2">
          <ind:filepath operation="pattern match">^\/etc\/rsyslog(\.conf|\.d\/.*\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\$((?:Input(?:TCP|RELP)|UDP)ServerRun|ModLoad[\s]+(imtcp|imudp|imrelp))</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten_rainerscript:obj:1" version="2">
          <ind:filepath operation="pattern match">^\/etc\/rsyslog(\.conf|\.d\/.*\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(?:module|input)\((?:load|type)="(imtcp|imudp)".*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.+\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*action\((?i)type(?-i)="omfwd"(.+?)\)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_network_configure_name_resolution:obj:1" version="1">
          <ind:filepath>/etc/resolv.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*nameserver[\s]+([0-9\.]+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_host_line_dns_parameter_nsswitch:obj:1" version="1">
          <ind:filepath>/etc/nsswitch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*hosts\s*:\s*.*dns.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_file_empty_resolv:obj:1" version="1">
          <unix:filepath>/etc/resolv.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_network_nmcli_permissions:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/polkit-1/localauthority/20-org.d/.*$</ind:filepath>
          <ind:pattern operation="pattern match">^\[.*\]\n\s*Identity=default\n\s*Action=org\.freedesktop\.NetworkManager\.\*\n\s*ResultAny=no\n\s*ResultInactive=no\n\s*(ResultActive=auth_admin)\n*\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
          <unix:name operation="pattern match">^.*$</unix:name>
          <oval-def:filter action="include">oval:ssg-state_promisc:ste:1</oval-def:filter>
        </unix:interface_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_loopback_restricted_source_usr:obj:1" version="1">
          <ind:filepath>/usr/lib/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/rule/source[@address='127.0.0.1' or @address='::1']</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_loopback_restricted_destination_usr:obj:1" version="1">
          <ind:filepath>/usr/lib/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/rule/destination[@address='127.0.0.1' or @address='::1' and @invert='True']</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_loopback_restricted_policy_usr:obj:1" version="1">
          <ind:filepath>/usr/lib/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/rule/drop</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_loopback_restricted_source_etc:obj:1" version="1">
          <ind:filepath>/etc/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/rule/source[@address='127.0.0.1' or @address='::1']</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_loopback_restricted_destination_etc:obj:1" version="1">
          <ind:filepath>/etc/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/rule/destination[@address='127.0.0.1' or @address='::1' and @invert='True']</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_loopback_restricted_policy_etc:obj:1" version="1">
          <ind:filepath>/etc/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/rule/drop</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_lo_interface_trusted_usr:obj:1" version="1">
          <ind:filepath>/usr/lib/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/interface[@name='lo']</ind:xpath>
        </ind:xmlfilecontent_object>
        <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_lo_interface_trusted_etc:obj:1" version="1">
          <ind:filepath>/etc/firewalld/zones/trusted.xml</ind:filepath>
          <ind:xpath>/zone/interface[@name='lo']</ind:xpath>
        </ind:xmlfilecontent_object>
        <unix:file_object id="oval:ssg-object_firewalld_customized_trusted_zone_file:obj:1" version="1">
          <unix:filepath>/etc/firewalld/zones/trusted.xml</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1" version="1" comment="ipv6 disabled any modprobe conf file">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*options\s+ipv6\s+.*disable=1.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:interface_object id="oval:ssg-object_active_wifi_interfaces:obj:1" version="1">
          <unix:name operation="pattern match">^wl.*$</unix:name>
        </unix:interface_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_networkmanager_dns_mode:obj:1" version="1">
          <ind:filepath>/etc/NetworkManager/NetworkManager.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[main\].*(?:\n\s*[^[\s].*)*\ndns=([^#]*).*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_networkmanager_dns_mode_config_file:obj:1" version="1" comment="The configuration file /etc/NetworkManager/NetworkManager.conf for networkmanager_dns_mode">
          <unix:filepath operation="pattern match">^/etc/NetworkManager/NetworkManager.conf</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-all_local_directories_uid_zero:obj:1" version="1" comment="collect all local directories and filter them by uid and others write permission">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_uid_is_not_root_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:partition_object id="oval:ssg-object_dir_perms_world_writable_sticky_bits_local_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">.*</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_dir_perms_world_writable_sticky_bits_dev_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_dir_perms_world_writable_sticky_bits:obj:1" version="1" comment="All world-writable directories without sticky bits">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="defined"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_dir_perms_world_writable_sticky_bits_local_mountpoints:var:1"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_dir_perms_world_writable_sticky_bits:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_system_commands_dirs_group_ownership:obj:1" version="1" comment="system commands directories">
          <unix:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_dirs_group_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_system_commands_directory_bin_ownership:obj:1" version="1" comment="system commands directories have root ownership">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_directory_bin_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_system_commands_directory_sbin_ownership:obj:1" version="1" comment="system commands directories have root ownership">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_directory_sbin_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_system_commands_directory_usr_bin_ownership:obj:1" version="1" comment="system commands directories have root ownership">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/usr/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_directory_usr_bin_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_system_commands_directory_usr_sbin_ownership:obj:1" version="1" comment="system commands directories have root ownership">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/usr/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_directory_usr_sbin_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_system_commands_directory_usr_local_bin_ownership:obj:1" version="1" comment="system commands directories have root ownership">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/usr/local/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_directory_usr_local_bin_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_ownership_system_commands_directory_usr_local_sbin_ownership:obj:1" version="1" comment="system commands directories have root ownership">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/usr/local/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_system_commands_directory_usr_local_sbin_owner_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:partition_object id="oval:ssg-object_file_permissions_unauthorized_sgid_local_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">.*</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_dev_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_file_permissions_unauthorized_sgid_all_sgid_files:obj:1" version="1" comment="all files with sgid set">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="defined"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_local_mountpoints:var:1"/>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_sgid_sysroot:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_file_permissions_unauthorized_sgid_rpms:obj:1" version="1" comment="all files with sgid set that come from a RPM package">
          <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="equals" var_check="all" var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_all_sgid_files:var:1"/>
        </linux:rpmverifyfile_object>
        <ind:variable_object id="oval:ssg-object_file_permissions_unauthorized_sgid_no_rpm_files:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_file_permissions_unauthorized_sgid_all_sgid_files:var:1</ind:var_ref>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_sgid_rpm_filepaths:ste:1</oval-def:filter>
        </ind:variable_object>
        <linux:partition_object id="oval:ssg-object_file_permissions_unauthorized_suid_local_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">.*</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_dev_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_file_permissions_unauthorized_suid_all_suid_files:obj:1" version="1" comment="all files with suid set">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="defined"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_unauthorized_suid_local_mountpoints:var:1"/>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_suid_sysroot:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_file_permissions_unauthorized_suid_rpms:obj:1" version="1" comment="all files with suid set that come from a RPM package">
          <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="equals" var_check="all" var_ref="oval:ssg-var_file_permissions_unauthorized_suid_all_suid_files:var:1"/>
        </linux:rpmverifyfile_object>
        <ind:variable_object id="oval:ssg-object_file_permissions_unauthorized_suid_no_rpm_files:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_file_permissions_unauthorized_suid_all_suid_files:var:1</ind:var_ref>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_suid_rpm_filepaths:ste:1</oval-def:filter>
        </ind:variable_object>
        <linux:partition_object id="oval:ssg-object_file_permissions_unauthorized_world_writable_local_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">.*</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_world_writable_dev_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1" comment="All files with world-write permission.">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="defined"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_unauthorized_world_writable_local_mountpoints:var:1"/>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_special_selinux_files:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_sysroot:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_group:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_usr_lib_group:obj:1" version="1">
          <ind:filepath>/usr/lib/group</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_all_gids_with_usrlib:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_etc_group:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_usr_lib_group:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_file_permissions_ungroupowned_local_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">.*</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_ungroupowned_dev_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="2" comment="all local files without a known group owner">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="defined" max_depth="-1"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_ungroupowned_local_mountpoints:var:1"/>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_ungroupowned_local_group_owner:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_ungroupowned_with_usrlib:obj:1" version="2" comment="all local files without a known group owner">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="defined" max_depth="-1"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_ungroupowned_local_mountpoints:var:1"/>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_ungroupowned_local_group_owner_with_usrlib:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_file_permissions_ungroupowned_nsswitch_uses_altfiles:obj:1" version="1">
          <ind:filepath>/etc/nsswitch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*group:\s+(.*)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-object_no_files_unowned_by_user_all_users:obj:1" version="2">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
        </unix:password_object>
        <linux:partition_object id="oval:ssg-object_no_files_unowned_by_user_local_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">.*</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_no_files_unowned_by_user_dev_partitons:ste:1</oval-def:filter>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_no_files_unowned_by_user:obj:1" version="2" comment="all local files without a known owner">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="defined" max_depth="-1"/>
          <unix:path operation="equals" var_check="at least one" var_ref="oval:ssg-var_no_files_unowned_by_user_local_mountpoints:var:1"/>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-state_no_files_unowned_by_user_uids_list:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_groupownership_system_commands_dirs:obj:1" version="1" comment="system commands files">
          <unix:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_groupowner_system_commands_dirs_not_root_or_system_account:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1" comment="binary directories">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1" comment="binary files">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1" comment="binary files">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_perms_binary_files_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/(?!boot|efi)\w.*$</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_local_nodev:ste:1</oval-def:filter>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_non_root_partitions_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(?!#)(?:/dev/\S+|UUID=\S+)\s+/\w\S*\s+\S+\s+(\S+)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_runtime:obj:1" version="1">
          <unix:name>kernel.core_pattern</unix:name>
        </unix:sysctl_object>
        <ind:variable_object id="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_defined_in_one_file:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_sysctl_kernel_core_pattern_empty_string_counter:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered:obj:1</oval-def:object_reference>
            <oval-def:filter action="exclude">oval:ssg-state_sysctl_kernel_core_pattern_empty_string_filepath_is_symlink:ste:1</oval-def:filter>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-var_object_symlink_sysctl_kernel_core_pattern_empty_string:obj:1" version="1" comment="combine the blank string with symlink paths found">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-var_obj_symlink_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-var_obj_blank_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_blank_sysctl_kernel_core_pattern_empty_string:obj:1" version="1" comment="variable object of the blank string">
          <ind:var_ref>oval:ssg-local_var_blank_path_sysctl_kernel_core_pattern_empty_string:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-var_obj_symlink_sysctl_kernel_core_pattern_empty_string:obj:1" version="1" comment="variable object of the symlinks found">
          <ind:var_ref>oval:ssg-local_var_symlinks_sysctl_kernel_core_pattern_empty_string:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object id="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_symlinks:obj:1" version="1" comment="Symlinks referencing files in default dirs">
          <unix:filepath operation="equals" var_ref="oval:ssg-local_var_conf_files_sysctl_kernel_core_pattern_empty_string:var:1"/>
          <oval-def:filter action="exclude">oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern_empty_string:ste:1</oval-def:filter>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_pattern_empty_string:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_sysctls_sysctl_kernel_core_pattern_empty_string:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern_empty_string:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern_empty_string:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[[:blank:]]*kernel.core_pattern[[:blank:]]*=[[:blank:]]*(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_backtraces:obj:1" version="1">
          <ind:filepath>/etc/systemd/coredump.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_backtraces_config_dir:obj:1" version="1">
          <ind:path>/etc/systemd/coredump.conf.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_storage:obj:1" version="1">
          <ind:filepath>/etc/systemd/coredump.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_storage_config_dir:obj:1" version="1">
          <ind:path>/etc/systemd/coredump.conf.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
          <ind:filepath>/etc/security/limits.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d_exists:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nx_disabled_grub:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">[\s]*noexec[\s]*=[\s]*off</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_NX_cpu_support:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_noexec_cmd_line:obj:1" version="1">
          <ind:filepath>/proc/cmdline</ind:filepath>
          <ind:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_default_grub:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub2_cfg:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found">
          <ind:filepath>/etc/grub2.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub_dir:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found">
          <ind:path>/etc/grub.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_dev_device_files:obj:1" version="1" comment="device files within /dev directory">
          <unix:behaviors recurse_direction="down"/>
          <unix:path operation="equals">/dev</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_block_or_char_device_file:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:selinuxsecuritycontext_object id="oval:ssg-object_selinux_dev_device_t:obj:1" version="1" comment="device_t in /dev">
          <linux:filepath operation="equals" var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
          <oval-def:filter action="include">oval:ssg-state_selinux_dev_device_t:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <linux:selinuxsecuritycontext_object id="oval:ssg-object_selinux_dev_unlabeled_t:obj:1" version="1" comment="unlabeled_t in /dev">
          <linux:filepath operation="equals" var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
          <oval-def:filter action="include">oval:ssg-state_selinux_dev_unlabeled_t:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <linux:selinuxsecuritycontext_object id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1" comment="find unconfined_service_t in /proc">
          <linux:behaviors max_depth="1" recurse_direction="down"/>
          <linux:path>/proc</linux:path>
          <linux:filename operation="pattern match">^.*$</linux:filename>
          <oval-def:filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_not_disabled:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUXTYPE=([\w]*)[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_package_kernel:obj:1" version="1">
          <linux:name>kernel</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_cpuinfo_64_bit:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags\s+:\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dconf_local_db:obj:1" version="1" comment="The binary system-wide dconf database with 'local' settings">
          <unix:filepath>/etc/dconf/db/local</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-obj_dconf_local_config:obj:1" version="1" comment="The dconf keyfile with 'local' settings">
          <unix:filepath operation="pattern match">^/etc/dconf/db/local.d/.*</unix:filepath>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_local_db_modified_time:obj:1" version="1" comment="All modified times of all keyfiles">
          <ind:var_ref>oval:ssg-var_dconf_local_db_modified_time:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2">
          <ind:filepath>/etc/dconf/profile/user</ind:filepath>
          <ind:pattern operation="pattern match">^user-db:user\nsystem-db:local$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_restart_buttons:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen\]([^\n]*\n+)+?disable-restart-buttons=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-restart-buttons$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_user_list:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen\]([^\n]*\n+)+?disable-user-list=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_user_list:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-user-list$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[xdmcp\].*(?:\n\s*[^[\s].*)*\n^\s*Enable[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1" version="1" comment="The configuration file /etc/gdm/custom.conf for gnome_gdm_disable_xdmcp">
          <unix:filepath operation="pattern match">^/etc/gdm/custom.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount-open=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_autorun:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_creds:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/Vino\]([^\n]*\n+)+?authentication-methods=\['vnc'\]$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_creds:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/Vino/authentication-methods$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_encryption:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/Vino\]([^\n]*\n+)+?require-encryption=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/Vino/require-encryption$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver\]([^\n]*\n+)+?idle-activation-enabled=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/session\]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^idle-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver\]([^\n]*\n+)+?lock-delay=uint32[\s][0-9]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^lock-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver\]([^\n]*\n+)+?lock-enabled=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver\]([^\n]*\n+)+?picture-uri=string \'\'$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/picture-uri$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/media-keys\]([^\n]*\n+)+?logout[\s]*=[\s]*\[''\]$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/media-keys/logout$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/named.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-crypto_policies_current_file:obj:1" version="1" comment="crypto-policies current state">
          <unix:filepath>/etc/crypto-policies/state/current</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-crypto_policies_config_file:obj:1" version="1" comment="crypto-policies config state">
          <unix:filepath datatype="string">/etc/crypto-policies/config</unix:filepath>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1" comment="Crypto policy current file timestamp">
          <ind:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/config</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/state/current</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1">
          <unix:filepath>/etc/crypto-policies/back-ends/nss.config</unix:filepath>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1" comment="kerberos crypto-policy configuration softlink">
          <unix:filepath>/etc/krb5.conf.d/crypto-policies</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1" comment="kerberos crypto-policy backend softlink">
          <unix:filepath>/etc/crypto-policies/back-ends/krb5.config</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/ipsec.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/pki/tls/openssl.cnf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/sshd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(?i)CRYPTO_POLICY\s*=.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*Match[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*RekeyLimit[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*GSSAPIAuthentication[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*Ciphers[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*PubkeyAcceptedKeyTypes[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*MACs[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*KexAlgorithms[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/openssh.config</ind:filepath>
          <ind:pattern operation="pattern match">^Ciphers.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_ciphers_opensshserver_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/opensshserver.config</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*Ciphers\s+([^\s']+).*$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/openssh.config</ind:filepath>
          <ind:pattern operation="pattern match">^MACs.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_macs_opensshserver_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/opensshserver.config</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*(-oMACs=\S+).+$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:process58_object id="oval:ssg-obj_agent_mfetpd_running:obj:1" version="1">
          <unix:command_line operation="pattern match">^mfetpd.*$</unix:command_line>
          <unix:pid datatype="int" operation="greater than">0</unix:pid>
        </unix:process58_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_dracut_fips_module:obj:1" version="1">
          <ind:filepath>/etc/dracut.conf.d/40-fips.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*add_dracutmodules\+="\s*(\w*)\s*"\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fips_1_argument_in_boot_loader_entries_conf:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/loader/entries/.*.conf</ind:filepath>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_system_crypto_policy_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_system_crypto_policy:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_proc_sys_crypto_fips_enabled:obj:1" version="1">
          <ind:filepath>/proc/sys/crypto/fips_enabled</ind:filepath>
          <ind:pattern operation="pattern match">^1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_etc_system_fips:obj:1" version="1">
          <unix:filepath>/etc/system-fips</unix:filepath>
        </unix:file_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1" version="1">
          <unix:name>crypto.fips_enabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_auditctl:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\/usr\/sbin\/auditctl\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_auditd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/auditd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_ausearch:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/ausearch\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_aureport:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/aureport\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_autrace:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/autrace\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_rsyslogd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_augenrules:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/augenrules\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1" comment="run aide with cron">
          <ind:filepath>/etc/crontab</ind:filepath>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1" comment="run aide with cron">
          <ind:path>/etc/cron.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1" comment="run aide with cron">
          <ind:filepath>/var/spool/cron/root</ind:filepath>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1" comment="run aide with cron.(daily|weekly)">
          <ind:path operation="pattern match">^/etc/cron.(daily|weekly)$</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^[^#]*\/usr\/sbin\/aide\s+\-\-check\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_aide_scan_notification:obj:1" version="1" comment="notify personnel when aide completes">
          <ind:filepath>/etc/crontab</ind:filepath>
          <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_var_cron_notification:obj:1" version="1" comment="notify personnel when aide completes">
          <ind:filepath>/var/spool/cron/root</ind:filepath>
          <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_crontabs_notification:obj:1" version="1" comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)">
          <ind:path operation="pattern match">^/etc/cron.(d|daily|weekly|monthly)$</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_non_fips_hashes:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[A-Z][a-zA-Z_]*[\s]*=[\s]*.*(sha1|rmd160|sha256|whirlpool|tiger|haval|gost|crc32).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_use_fips_hashes:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[A-Z][A-Za-z_]*[\s]*=[\s]*([a-zA-Z0-9\+]*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_acls:obj:1" version="2">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?!ALLXTRAHASHES)[A-Z][a-zA-Z_]*[\s]*=[\s]*([a-zA-Z0-9\+]*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_ext_attributes:obj:1" version="2">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?!ALLXTRAHASHES)[A-Z][a-zA-Z_]*[\s]*=[\s]*([a-zA-Z0-9\+]*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_rpm_verify_hashes_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
          <linux:behaviors nomd5="false"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">^/(bin|sbin|lib|lib64|usr)/.+$</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_rpm_verify_hashes_fail_md5_hash:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_rpm_verify_ownership_files_fail_ownership:obj:1" version="2" comment="rpm verify ownership of all files">
          <linux:behaviors nomd5="true" noghostfiles="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">.*</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_rpm_verify_ownership_files_fail_ownership:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_rpm_verify_permissions_files_fail_mode:obj:1" version="1" comment="rpm verify permissions of all files">
          <linux:behaviors nomd5="true" noghostfiles="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">.*</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_rpm_verify_permissions_files_fail_mode:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <unix:file_object id="oval:ssg-object_sudo_file:obj:1" version="1" comment="Fetch /usr/bin/sudo">
          <unix:filepath>/usr/bin/sudo</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-sudo_dedicated_group_gid:obj:1" version="1" comment="Grab GID of group set in var_sudo_dedicated_group">
          <ind:filepath operation="equals">/etc/group</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-sudo_dedicated_group_regex_for_gid:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sudo_timestamp_timeout:obj:1" version="1">
          <ind:filepath operation="pattern match">^\/etc\/(sudoers|sudoers\.d\/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults[\s]+timestamp_timeout[\s]*=\s*[+]?(\d*\.\d+|\d+\.\d*|\d+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sudo_timestamp_timeout_no_signs:obj:1" version="1">
          <ind:filepath operation="pattern match">^\/etc\/(sudoers|sudoers\.d\/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults[\s]+timestamp_timeout[\s]*=\s*[\-](\d*\.\d+|\d+\.\d*|\d+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_cfg_spec_all_users:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*ALL\s+ALL\=\(ALL\)\s+ALL\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_cfg_spec_all_group:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*ALL\s+ALL\=\(ALL\:ALL\)\s+ALL\s*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_explicit_command_args:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(?!\s*Defaults)(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_no_command_negation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-root_or_ALL_in_runas_spec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_runas_spec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_targetpw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_rootpw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_runaspw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_targetpw_not_defined:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults targetpw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_rootpw_not_defined:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults rootpw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_runaspw_not_defined:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults runaspw$\r?\n</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_yum_clean_components_post_updating:obj:1" version="1" comment="clean_requirements_on_remove set in /etc/yum.conf">
          <ind:filepath>/etc/yum.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*clean_requirements_on_remove\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_apply_updates:obj:1" version="1">
          <ind:filepath>/etc/dnf/automatic.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*apply_updates[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1" version="1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_apply_updates">
          <unix:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1" version="1">
          <ind:filepath>/etc/dnf/automatic.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*upgrade_type[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1" version="1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_security_updates_only">
          <unix:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" version="1" comment="gpgcheck set in /etc/yum.conf">
          <ind:filepath>/etc/yum.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" version="1" comment="localpkg_gpgcheck set in /etc/yum.conf">
          <ind:filepath>/etc/yum.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*localpkg_gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
          <ind:path>/etc/yum.repos.d</ind:path>
          <ind:filename operation="pattern match">.*</ind:filename>
          <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-object_oracle_package_gpg-pubkey:obj:1" version="1">
          <linux:name>gpg-pubkey</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bdcredit\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*dcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dictcheck_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bdictcheck\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*dictcheck[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bdifok\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*difok[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\blcredit\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*lcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bmaxclassrepeat\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*maxclassrepeat[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bmaxrepeat\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*maxrepeat[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bminclass\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*minclass[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bminlen\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*minlen[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bocredit\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*ocredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit_not_overwritten:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password.*pam_pwquality\.so.*\bucredit\b</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3">
          <ind:filepath operation="pattern match">^/etc/security/pwquality\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*ucredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1" version="2" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1" version="2" comment="Check common definition of pam_faillock.so in auth section of common-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1" version="2" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1" version="2" comment="Check common definition of pam_faillock.so in auth section of common-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1" version="2" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1" version="2" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1" version="2" comment="Get the pam_faillock.so deny parameter from system-auth file">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1" version="2" comment="Get the pam_faillock.so deny parameter from password-auth file">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so deny parameter in /etc/security/faillock.conf">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system_pam_unix_auth:obj:1" version="2" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_auth:obj:1" version="2" comment="Check common definition of pam_faillock.so in auth section of common-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password_pam_unix_auth:obj:1" version="2" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_auth:obj:1" version="2" comment="Check common definition of pam_faillock.so in auth section of common-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_account:obj:1" version="2" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_account:obj:1" version="2" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:obj:1" version="2" comment="Get the pam_faillock.so fail_interval parameter from system-auth file">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_fail_interval_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:obj:1" version="2" comment="Get the pam_faillock.so fail_interval parameter from password-auth file">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_fail_interval_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so fail_interval parameter in /etc/security/faillock.conf">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_faillock_conf_fail_interval_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1" version="2" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1" version="2" comment="Check common definition of pam_faillock.so in auth section of common-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1" version="2" comment="Get the second and subsequent occurrences of pam_unix.so in auth section of password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1" version="2" comment="Check common definition of pam_faillock.so in auth section of common-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1" version="2" comment="Check common definition of pam_faillock.so in account section of system-auth">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1" version="2" comment="Check common definition of pam_faillock.so in account section of password-auth">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1" version="2" comment="Get the pam_faillock.so unlock_time parameter from system-auth file">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1" version="2" comment="Get the pam_faillock.so unlock_time parameter from password-auth file">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1" version="1" comment="Check the expected pam_faillock.so unlock_time parameter in /etc/security/faillock.conf">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_access_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-3-access-failed.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_access_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-3-access-success.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_basic_configuration_object_whole_file_contents_tc_audit_rules_d_10_base_config_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/10-base-config.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_create_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-1-create-failed.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_create_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-1-create-success.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_delete_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_delete_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-4-delete-success.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_immutable_login_uids_object_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/11-loginuid.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_modify_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_modify_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-2-modify-success.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_module_load_object_whole_file_contents_tc_audit_rules_d_43_module_load_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/43-module-load.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_ospp_general_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_owner_change_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_owner_change_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_perm_change_failed_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-audit_perm_change_success_object_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_init_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/init(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_init_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/init(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_poweroff_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/poweroff(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_poweroff_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/poweroff(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_reboot_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/reboot(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_reboot_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/reboot(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_shutdown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/shutdown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_privileged_commands_shutdown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/shutdown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chacl_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chacl_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setfacl_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/setfacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setfacl_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/setfacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setfiles_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setfiles(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setfiles_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setfiles(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_var_accounts_passwords_pam_faillock_dir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_dir_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_var_accounts_passwords_pam_faillock_dir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_dir_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-lastlog_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-lastlog_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-tallylog_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-tallylog_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_kmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/kmod(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_kmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/kmod(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pam_timestamp_check_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/pam_timestamp_check(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pam_timestamp_check_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/pam_timestamp_check(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_postdrop_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postdrop(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_postdrop_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postdrop(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_postqueue_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postqueue(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_postqueue_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/postqueue(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_agent_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/ssh-agent(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_agent_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/ssh-agent(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_update_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_update(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_update_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_update(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usermod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usermod(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usermod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usermod(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_sudo_log_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-sudo_log_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_sudo_log_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-sudo_log_path_pattern:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_freq:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_local_events:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_log_format:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[org/gnome/settings-daemon/peripherals/smartcard\].*(?:\n\s*[^[\s].*)*\n^\s*removal-action[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_removal-action:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_0:obj:1" version="1" comment="/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_1:obj:1" version="1" comment="/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdir_group_ownership_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_0:obj:1" version="1" comment="/bin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_1:obj:1" version="1" comment="/sbin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_2:obj:1" version="1" comment="/usr/bin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_3:obj:1" version="1" comment="/usr/sbin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_4:obj:1" version="1" comment="/usr/local/bin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_binary_dirs_5:obj:1" version="1" comment="/usr/local/sbin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_0:obj:1" version="1" comment="/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_1:obj:1" version="1" comment="/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdir_ownership_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_0:obj:1" version="1" comment="/bin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_1:obj:1" version="1" comment="/sbin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_2:obj:1" version="1" comment="/usr/bin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_3:obj:1" version="1" comment="/usr/sbin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_4:obj:1" version="1" comment="/usr/local/bin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/bin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_binary_dirs_5:obj:1" version="1" comment="/usr/local/sbin/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/local/sbin</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_0:obj:1" version="1" comment="/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_1:obj:1" version="1" comment="/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdir_permissions_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdirectory_groupowner_etc_ipsecd_0:obj:1" version="1" comment="/etc/ipsec.d/">
          <unix:path>/etc/ipsec.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_ipsecd_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdirectory_groupowner_etc_ipsecd_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_ipsecd_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdirectory_groupowner_etc_iptables_0:obj:1" version="1" comment="/etc/iptables/">
          <unix:path>/etc/iptables</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_iptables_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdirectory_groupowner_etc_iptables_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_iptables_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdirectory_groupowner_etc_nftables_0:obj:1" version="1" comment="/etc/nftables/">
          <unix:path>/etc/nftables</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_nftables_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdirectory_groupowner_etc_nftables_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_nftables_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdirectory_groupowner_etc_selinux_0:obj:1" version="1" comment="/etc/selinux/">
          <unix:path>/etc/selinux</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_selinux_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdirectory_groupowner_etc_selinux_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_selinux_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdirectory_groupowner_etc_sudoersd_0:obj:1" version="1" comment="/etc/sudoers.d/">
          <unix:path>/etc/sudoers.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_sudoersd_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdirectory_groupowner_etc_sudoersd_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_sudoersd_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownerdirectory_groupowner_etc_sysctld_0:obj:1" version="1" comment="/etc/sysctl.d/">
          <unix:path>/etc/sysctl.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_sysctld_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerdirectory_groupowner_etc_sysctld_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_sysctld_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_ownerdirectory_owner_etc_ipsecd_0:obj:1" version="1" comment="/etc/ipsec.d/">
          <unix:path>/etc/ipsec.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdirectory_owner_etc_ipsecd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdirectory_owner_etc_ipsecd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdirectory_owner_etc_iptables_0:obj:1" version="1" comment="/etc/iptables/">
          <unix:path>/etc/iptables</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdirectory_owner_etc_iptables_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdirectory_owner_etc_iptables_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdirectory_owner_etc_nftables_0:obj:1" version="1" comment="/etc/nftables/">
          <unix:path>/etc/nftables</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdirectory_owner_etc_nftables_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdirectory_owner_etc_nftables_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdirectory_owner_etc_selinux_0:obj:1" version="1" comment="/etc/selinux/">
          <unix:path>/etc/selinux</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdirectory_owner_etc_selinux_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdirectory_owner_etc_selinux_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdirectory_owner_etc_sudoersd_0:obj:1" version="1" comment="/etc/sudoers.d/">
          <unix:path>/etc/sudoers.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdirectory_owner_etc_sudoersd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdirectory_owner_etc_sudoersd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerdirectory_owner_etc_sysctld_0:obj:1" version="1" comment="/etc/sysctl.d/">
          <unix:path>/etc/sysctl.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerdirectory_owner_etc_sysctld_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerdirectory_owner_etc_sysctld_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdirectory_permissions_etc_ipsecd_0:obj:1" version="1" comment="/etc/ipsec.d/">
          <unix:path>/etc/ipsec.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_directory_permissions_etc_ipsecd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdirectory_permissions_etc_ipsecd_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdirectory_permissions_etc_iptables_0:obj:1" version="1" comment="/etc/iptables/">
          <unix:path>/etc/iptables</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_directory_permissions_etc_iptables:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdirectory_permissions_etc_iptables_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdirectory_permissions_etc_nftables_0:obj:1" version="1" comment="/etc/nftables/">
          <unix:path>/etc/nftables</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_directory_permissions_etc_nftables:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdirectory_permissions_etc_nftables_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdirectory_permissions_etc_selinux_0:obj:1" version="1" comment="/etc/selinux/">
          <unix:path>/etc/selinux</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_directory_permissions_etc_selinux:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdirectory_permissions_etc_selinux_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdirectory_permissions_etc_sudoersd_0:obj:1" version="1" comment="/etc/sudoers.d/">
          <unix:path>/etc/sudoers.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_directory_permissions_etc_sudoersd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdirectory_permissions_etc_sudoersd_0_mode_0750or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsdirectory_permissions_etc_sysctld_0:obj:1" version="1" comment="/etc/sysctl.d/">
          <unix:path>/etc/sysctl.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_directory_permissions_etc_sysctld:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsdirectory_permissions_etc_sysctld_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_disable_host_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_disable_host_auth:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_disable_host_auth:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_disable_host_auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_disable_host_auth_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_at_deny_not_exist:obj:1" version="1" comment="/etc/at.deny">
          <unix:filepath>/etc/at.deny</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_0:obj:1" version="1" comment="/sbin/auditctl">
          <unix:filepath>/sbin/auditctl</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_1:obj:1" version="1" comment="/sbin/aureport">
          <unix:filepath>/sbin/aureport</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_2:obj:1" version="1" comment="/sbin/ausearch">
          <unix:filepath>/sbin/ausearch</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_3:obj:1" version="1" comment="/sbin/autrace">
          <unix:filepath>/sbin/autrace</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_4:obj:1" version="1" comment="/sbin/auditd">
          <unix:filepath>/sbin/auditd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_4:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_5:obj:1" version="1" comment="/sbin/rsyslogd">
          <unix:filepath>/sbin/rsyslogd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_5:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_6:obj:1" version="1" comment="/sbin/augenrules">
          <unix:filepath>/sbin/augenrules</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_6:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_0:obj:1" version="1" comment="/sbin/auditctl">
          <unix:filepath>/sbin/auditctl</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_1:obj:1" version="1" comment="/sbin/aureport">
          <unix:filepath>/sbin/aureport</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_2:obj:1" version="1" comment="/sbin/ausearch">
          <unix:filepath>/sbin/ausearch</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_3:obj:1" version="1" comment="/sbin/autrace">
          <unix:filepath>/sbin/autrace</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_4:obj:1" version="1" comment="/sbin/auditd">
          <unix:filepath>/sbin/auditd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_4:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_5:obj:1" version="1" comment="/sbin/rsyslogd">
          <unix:filepath>/sbin/rsyslogd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_5:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownerfile_audit_tools_ownership_6:obj:1" version="1" comment="/sbin/augenrules">
          <unix:filepath>/sbin/augenrules</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_6:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_0:obj:1" version="1" comment="/sbin/auditctl">
          <unix:filepath>/sbin/auditctl</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_1:obj:1" version="1" comment="/sbin/aureport">
          <unix:filepath>/sbin/aureport</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_1_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_2:obj:1" version="1" comment="/sbin/ausearch">
          <unix:filepath>/sbin/ausearch</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_2_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_3:obj:1" version="1" comment="/sbin/autrace">
          <unix:filepath>/sbin/autrace</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_3_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_4:obj:1" version="1" comment="/sbin/auditd">
          <unix:filepath>/sbin/auditd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_4_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_5:obj:1" version="1" comment="/sbin/rsyslogd">
          <unix:filepath>/sbin/rsyslogd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_5_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissionsfile_audit_tools_permissions_6:obj:1" version="1" comment="/sbin/augenrules">
          <unix:filepath>/sbin/augenrules</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissionsfile_audit_tools_permissions_6_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_cron_deny_not_exist:obj:1" version="1" comment="/etc/cron.deny">
          <unix:filepath>/etc/cron.deny</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_at_allow_0:obj:1" version="1" comment="/etc/at.allow">
          <unix:filepath>/etc/at.allow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_at_allow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_at_allow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1" version="1" comment="/etc/group-">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow-">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1" version="1" comment="/etc/passwd-">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1" version="1" comment="/etc/shadow-">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_allow_0:obj:1" version="1" comment="/etc/cron.allow">
          <unix:filepath>/etc/cron.allow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_allow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_allow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_d_0:obj:1" version="1" comment="/etc/cron.d/">
          <unix:path>/etc/cron.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_d_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_d_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_daily_0:obj:1" version="1" comment="/etc/cron.daily/">
          <unix:path>/etc/cron.daily</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_daily_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_daily_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_deny_0:obj:1" version="1" comment="/etc/cron.deny">
          <unix:filepath>/etc/cron.deny</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_deny_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_deny_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_hourly_0:obj:1" version="1" comment="/etc/cron.hourly/">
          <unix:path>/etc/cron.hourly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_hourly_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_hourly_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_monthly_0:obj:1" version="1" comment="/etc/cron.monthly/">
          <unix:path>/etc/cron.monthly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_monthly_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_monthly_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_cron_weekly_0:obj:1" version="1" comment="/etc/cron.weekly/">
          <unix:path>/etc/cron.weekly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_cron_weekly_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_cron_weekly_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_crontab_0:obj:1" version="1" comment="/etc/crontab">
          <unix:filepath>/etc/crontab</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_crontab_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_crontab_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_efi_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_efi_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_efi_user_cfg_0:obj:1" version="1" comment="/boot/grub2/user.cfg">
          <unix:filepath>/boot/grub2/user.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_efi_user_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_efi_user_cfg_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_crypttab_0:obj:1" version="1" comment="/etc/crypttab">
          <unix:filepath>/etc/crypttab</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_crypttab_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_crypttab_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupowner_etc_crypttab_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_group_0:obj:1" version="1" comment="/etc/group">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_ipsec_conf_0:obj:1" version="1" comment="/etc/ipsec.conf">
          <unix:filepath>/etc/ipsec.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_ipsec_conf_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_ipsec_conf_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupowner_etc_ipsec_conf_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_ipsec_secrets_0:obj:1" version="1" comment="/etc/ipsec.secrets">
          <unix:filepath>/etc/ipsec.secrets</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_ipsec_secrets_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_ipsec_secrets_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupowner_etc_ipsec_secrets_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_issue_net_0:obj:1" version="1" comment="/etc/issue.net">
          <unix:filepath>/etc/issue.net</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_issue_net_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_issue_net_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_passwd_0:obj:1" version="1" comment="/etc/passwd">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_sestatus_conf_0:obj:1" version="1" comment="/etc/sestatus.conf">
          <unix:filepath>/etc/sestatus.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_sestatus_conf_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_sestatus_conf_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupowner_etc_sestatus_conf_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_shadow_0:obj:1" version="1" comment="/etc/shadow">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_shells_0:obj:1" version="1" comment="/etc/shells">
          <unix:filepath>/etc/shells</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_shells_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_shells_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_etc_sudoers_0:obj:1" version="1" comment="/etc/sudoers">
          <unix:filepath>/etc/sudoers</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_etc_sudoers_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_etc_sudoers_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupowner_etc_sudoers_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_sshd_config_0:obj:1" version="1" comment="/etc/ssh/sshd_config">
          <unix:filepath>/etc/ssh/sshd_config</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_sshd_config_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_sshd_config_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_systemmap_0:obj:1" version="1" comment="/boot/">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^.*System\.map.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_systemmap_uid_root:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_systemmap_gid_root_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupowner_systemmap_uid_root:obj:1" version="1" comment="gid of the dedicated root group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_user_cfg_0:obj:1" version="1" comment="/boot/grub2/user.cfg">
          <unix:filepath>/boot/grub2/user.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_user_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_user_cfg_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_var_log_0:obj:1" version="1" comment="/var/log/">
          <unix:path>/var/log</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_var_log_messages_0:obj:1" version="1" comment="/var/log/messages">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupowner_var_log_syslog_0:obj:1" version="1" comment="/var/log/syslog">
          <unix:filepath>/var/log/syslog</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownership_audit_configuration_0:obj:1" version="1" comment="/etc/audit/">
          <unix:path>/etc/audit</unix:path>
          <unix:filename operation="pattern match">^.*audit(\.rules|d\.conf)$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownership_audit_configuration_1:obj:1" version="1" comment="/etc/audit/rules.d/">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*\.rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownership_sshd_private_key_0:obj:1" version="1" comment="/etc/ssh/">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*_key$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownership_sshd_private_key_uid_ssh_keys:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownership_sshd_private_key_gid_ssh_keys_0:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dedicated_groupownership_sshd_private_key_uid_ssh_keys:obj:1" version="1" comment="gid of the dedicated ssh_keys group">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^ssh_keys:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_groupownership_sshd_pub_key_0:obj:1" version="1" comment="/etc/ssh/">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*\.pub$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownership_sshd_pub_key_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownership_sshd_pub_key_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_backup_etc_group_0:obj:1" version="1" comment="/etc/group-">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow-">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1" version="1" comment="/etc/passwd-">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1" version="1" comment="/etc/shadow-">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_allow_0:obj:1" version="1" comment="/etc/cron.allow">
          <unix:filepath>/etc/cron.allow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_allow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_allow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_d_0:obj:1" version="1" comment="/etc/cron.d/">
          <unix:path>/etc/cron.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_d_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_d_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_daily_0:obj:1" version="1" comment="/etc/cron.daily/">
          <unix:path>/etc/cron.daily</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_daily_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_daily_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_deny_0:obj:1" version="1" comment="/etc/cron.deny">
          <unix:filepath>/etc/cron.deny</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_deny_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_deny_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_hourly_0:obj:1" version="1" comment="/etc/cron.hourly/">
          <unix:path>/etc/cron.hourly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_hourly_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_hourly_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_monthly_0:obj:1" version="1" comment="/etc/cron.monthly/">
          <unix:path>/etc/cron.monthly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_monthly_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_monthly_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_cron_weekly_0:obj:1" version="1" comment="/etc/cron.weekly/">
          <unix:path>/etc/cron.weekly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_cron_weekly_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_cron_weekly_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_crontab_0:obj:1" version="1" comment="/etc/crontab">
          <unix:filepath>/etc/crontab</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_crontab_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_crontab_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_efi_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_efi_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_efi_grub2_cfg_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_efi_user_cfg_0:obj:1" version="1" comment="/boot/grub2/user.cfg">
          <unix:filepath>/boot/grub2/user.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_efi_user_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_efi_user_cfg_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_chrony_keys_0:obj:1" version="1" comment="/etc/chrony.keys">
          <unix:filepath>/etc/chrony.keys</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_chrony_keys_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_chrony_keys_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_crypttab_0:obj:1" version="1" comment="/etc/crypttab">
          <unix:filepath>/etc/crypttab</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_crypttab_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_crypttab_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_group_0:obj:1" version="1" comment="/etc/group">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_ipsec_conf_0:obj:1" version="1" comment="/etc/ipsec.conf">
          <unix:filepath>/etc/ipsec.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_ipsec_conf_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_ipsec_conf_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_ipsec_secrets_0:obj:1" version="1" comment="/etc/ipsec.secrets">
          <unix:filepath>/etc/ipsec.secrets</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_ipsec_secrets_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_ipsec_secrets_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_issue_net_0:obj:1" version="1" comment="/etc/issue.net">
          <unix:filepath>/etc/issue.net</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_issue_net_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_issue_net_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_passwd_0:obj:1" version="1" comment="/etc/passwd">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_sestatus_conf_0:obj:1" version="1" comment="/etc/sestatus.conf">
          <unix:filepath>/etc/sestatus.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_sestatus_conf_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_sestatus_conf_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_shadow_0:obj:1" version="1" comment="/etc/shadow">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_shells_0:obj:1" version="1" comment="/etc/shells">
          <unix:filepath>/etc/shells</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_shells_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_shells_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_etc_sudoers_0:obj:1" version="1" comment="/etc/sudoers">
          <unix:filepath>/etc/sudoers</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_etc_sudoers_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_etc_sudoers_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_sshd_config_0:obj:1" version="1" comment="/etc/ssh/sshd_config">
          <unix:filepath>/etc/ssh/sshd_config</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_sshd_config_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_sshd_config_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_systemmap_0:obj:1" version="1" comment="/boot/">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^.*System\.map.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_systemmap_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_systemmap_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_user_cfg_0:obj:1" version="1" comment="/boot/grub2/user.cfg">
          <unix:filepath>/boot/grub2/user.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_user_cfg_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_user_cfg_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_var_log_0:obj:1" version="1" comment="/var/log/">
          <unix:path>/var/log</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_var_log_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_var_log_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_var_log_messages_0:obj:1" version="1" comment="/var/log/messages">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_owner_var_log_syslog_0:obj:1" version="1" comment="/var/log/syslog">
          <unix:filepath>/var/log/syslog</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_audit_configuration_0:obj:1" version="1" comment="/etc/audit/">
          <unix:path>/etc/audit</unix:path>
          <unix:filename operation="pattern match">^.*audit(\.rules|d\.conf)$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_audit_configuration_1:obj:1" version="1" comment="/etc/audit/rules.d/">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*\.rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_library_dirs_0:obj:1" version="1" comment="/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_library_dirs_1:obj:1" version="1" comment="/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_sshd_private_key_0:obj:1" version="1" comment="/etc/ssh/">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*_key$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_sshd_private_key_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_sshd_private_key_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_ownership_sshd_pub_key_0:obj:1" version="1" comment="/etc/ssh/">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*\.pub$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_ownership_sshd_pub_key_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_ownership_sshd_pub_key_uid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_at_allow_0:obj:1" version="1" comment="/etc/at.allow">
          <unix:filepath>/etc/at.allow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__at_allow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_at_allow_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_audit_configuration_0:obj:1" version="1" comment="/etc/audit/">
          <unix:path>/etc/audit</unix:path>
          <unix:filename operation="pattern match">^.*audit(\.rules|d\.conf)$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__audit_configuration:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_audit_configuration_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_audit_configuration_1:obj:1" version="1" comment="/etc/audit/rules.d/">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*\.rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__audit_configuration:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_audit_configuration_1_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_backup_etc_group_0:obj:1" version="1" comment="/etc/group-">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_group:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_backup_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow-">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_backup_etc_passwd_0:obj:1" version="1" comment="/etc/passwd-">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_backup_etc_shadow_0:obj:1" version="1" comment="/etc/shadow-">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_cron_allow_0:obj:1" version="1" comment="/etc/cron.allow">
          <unix:filepath>/etc/cron.allow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__cron_allow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_cron_allow_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_cron_d_0:obj:1" version="1" comment="/etc/cron.d/">
          <unix:path>/etc/cron.d</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__cron_d:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_cron_d_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_cron_daily_0:obj:1" version="1" comment="/etc/cron.daily/">
          <unix:path>/etc/cron.daily</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__cron_daily:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_cron_daily_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_cron_hourly_0:obj:1" version="1" comment="/etc/cron.hourly/">
          <unix:path>/etc/cron.hourly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__cron_hourly:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_cron_hourly_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_cron_monthly_0:obj:1" version="1" comment="/etc/cron.monthly/">
          <unix:path>/etc/cron.monthly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__cron_monthly:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_cron_monthly_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_cron_weekly_0:obj:1" version="1" comment="/etc/cron.weekly/">
          <unix:path>/etc/cron.weekly</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__cron_weekly:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_cron_weekly_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_crontab_0:obj:1" version="1" comment="/etc/crontab">
          <unix:filepath>/etc/crontab</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__crontab:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_crontab_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_efi_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__efi_grub2_cfg:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_efi_grub2_cfg_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_efi_user_cfg_0:obj:1" version="1" comment="/boot/grub2/user.cfg">
          <unix:filepath>/boot/grub2/user.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__efi_user_cfg:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_efi_user_cfg_0_mode_0700or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_audit_auditd_0:obj:1" version="1" comment="/etc/audit/auditd.conf">
          <unix:filepath>/etc/audit/auditd.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_audit_rulesd_0:obj:1" version="1" comment="/etc/audit/rules.d/">
          <unix:path>/etc/audit/rules.d</unix:path>
          <unix:filename operation="pattern match">^.*rules$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_chrony_keys_0:obj:1" version="1" comment="/etc/chrony.keys">
          <unix:filepath>/etc/chrony.keys</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_chrony_keys:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_chrony_keys_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_crypttab_0:obj:1" version="1" comment="/etc/crypttab">
          <unix:filepath>/etc/crypttab</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_crypttab:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_crypttab_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_group_0:obj:1" version="1" comment="/etc/group">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_group:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_gshadow_0:obj:1" version="1" comment="/etc/gshadow">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_gshadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_ipsec_conf_0:obj:1" version="1" comment="/etc/ipsec.conf">
          <unix:filepath>/etc/ipsec.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_ipsec_conf:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_ipsec_conf_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_ipsec_secrets_0:obj:1" version="1" comment="/etc/ipsec.secrets">
          <unix:filepath>/etc/ipsec.secrets</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_ipsec_secrets:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_ipsec_secrets_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_issue_net_0:obj:1" version="1" comment="/etc/issue.net">
          <unix:filepath>/etc/issue.net</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_issue_net:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_issue_net_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_passwd_0:obj:1" version="1" comment="/etc/passwd">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_passwd:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_sestatus_conf_0:obj:1" version="1" comment="/etc/sestatus.conf">
          <unix:filepath>/etc/sestatus.conf</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_sestatus_conf:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_sestatus_conf_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_shadow_0:obj:1" version="1" comment="/etc/shadow">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_shadow:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_shells_0:obj:1" version="1" comment="/etc/shells">
          <unix:filepath>/etc/shells</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_shells:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_shells_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_etc_sudoers_0:obj:1" version="1" comment="/etc/sudoers">
          <unix:filepath>/etc/sudoers</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__etc_sudoers:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_etc_sudoers_0_mode_0440or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_grub2_cfg_0:obj:1" version="1" comment="/boot/grub2/grub.cfg">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__grub2_cfg:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_library_dirs_0:obj:1" version="1" comment="/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_library_dirs_1:obj:1" version="1" comment="/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_library_dirs_2:obj:1" version="1" comment="/usr/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_library_dirs_3:obj:1" version="1" comment="/usr/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__library_dirs:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_sshd_config_0:obj:1" version="1" comment="/etc/ssh/sshd_config">
          <unix:filepath>/etc/ssh/sshd_config</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__sshd_config:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_sshd_config_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_sshd_pub_key_0:obj:1" version="1" comment="/etc/ssh/">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">^.*\.pub$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__sshd_pub_key:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_sudo_0:obj:1" version="1" comment="/usr/bin/sudo">
          <unix:filepath>/usr/bin/sudo</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__sudo:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_sudo_0_mode_4110:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_systemmap_0:obj:1" version="1" comment="/boot/">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^.*System\.map.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__systemmap:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_systemmap_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_user_cfg_0:obj:1" version="1" comment="/boot/grub2/user.cfg">
          <unix:filepath>/boot/grub2/user.cfg</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__user_cfg:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_user_cfg_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_var_log_0:obj:1" version="1" comment="/var/log/">
          <unix:path>/var/log</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__var_log:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_var_log_messages_0:obj:1" version="1" comment="/var/log/messages">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__var_log_messages:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_var_log_messages_0_mode_0600or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_permissions_var_log_syslog_0:obj:1" version="1" comment="/var/log/syslog">
          <unix:filepath>/var/log/syslog</unix:filepath>
          <oval-def:filter action="exclude">oval:ssg-exclude_symlinks__var_log_syslog:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_sshd_50_redhat_exists:obj:1" version="1" comment="/etc/ssh/sshd_config.d/50-redhat.conf">
          <unix:filepath>/etc/ssh/sshd_config.d/50-redhat.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_firewalld-backend:obj:1" version="1">
          <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*FirewallBackend=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_audit_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_audit_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_audit_backlog_limit_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_audit_backlog_limit_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_iommu_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_enable_iommu_force:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_init_on_alloc_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_init_on_alloc_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_init_on_alloc_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_init_on_alloc_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_l1tf_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_l1tf_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_l1tf_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_l1tf_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mce_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mce_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_mce_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_mce_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mds_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_mds_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_mds_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_mds_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmap_argument_absent:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmap\b.*).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmap_argument_absent_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmap\b).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_nosmap_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_nosmap_argument_absent:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmep_argument_absent:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bnosmep\b.*).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_nosmep_argument_absent_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bnosmep\b).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_nosmep_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_nosmep_argument_absent:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_alloc_shuffle_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_alloc_shuffle_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_page_alloc_shuffle_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_page_alloc_shuffle_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_page_poison_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_page_poison_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_pti_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_pti_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_rng_core_default_quality_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_rng_core_default_quality_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_rng_core_default_quality_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_rng_core_default_quality_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slab_nomerge_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slab_nomerge_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_slab_nomerge_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_slab_nomerge_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_slub_debug_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_slub_debug_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spec_store_bypass_disable_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spec_store_bypass_disable_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_spec_store_bypass_disable_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_spec_store_bypass_disable_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spectre_v2_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_spectre_v2_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_spectre_v2_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_spectre_v2_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_systemd_debug_shell_argument_absent:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?!.*\bsystemd.debug-shell\b.*).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_systemd_debug_shell_argument_absent_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(?!.*\bsystemd.debug-shell\b).*"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_systemd_debug_shell_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_systemd_debug-shell_argument_absent:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_vsyscall_entries:obj:1" version="1">
          <ind:path>/boot/loader/entries/</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_grub2_rescue_entry_for_grub2_vsyscall_argument:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1" version="1">
          <linux:name>openssl-pkcs11</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_acpi_custom_method:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_ACPI_CUSTOM_METHOD="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_acpi_custom_method_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_acpi_custom_method_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_ARM64_SW_TTBR0_PAN="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_arm64_sw_ttbr0_pan_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_binfmt_misc:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_BINFMT_MISC="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_binfmt_misc_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_binfmt_misc_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_bug:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_BUG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_bug_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_bug_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_bug_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_BUG_ON_DATA_CORRUPTION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_bug_on_data_corruption_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_bug_on_data_corruption_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_bug_on_data_corruption_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_compat_brk:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_COMPAT_BRK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_compat_brk_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_compat_brk_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_compat_vdso:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_COMPAT_VDSO="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_compat_vdso_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_compat_vdso_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_credentials:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_CREDENTIALS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_credentials_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_debug_credentials_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_fs:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_FS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_fs_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_debug_fs_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_list:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_LIST="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_list_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_debug_list_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_notifiers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_NOTIFIERS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_notifiers_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_debug_notifiers_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_sg:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_SG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_sg_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_debug_sg_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_debug_wx:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEBUG_WX="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_debug_wx_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_debug_wx_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_debug_wx_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_devkmem:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_DEVKMEM="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_devkmem_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_devkmem_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_fortify_source:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_FORTIFY_SOURCE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_fortify_source_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_fortify_source_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_fortify_source_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_LATENT_ENTROPY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_latent_entropy_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_RANDSTRUCT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_randstruct_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_randstruct_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_gcc_plugin_randstruct_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STACKLEAK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_stackleak_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_stackleak_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_gcc_plugin_stackleak_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STRUCTLEAK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_structleak_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_gcc_plugin_structleak_byref_all_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_hardened_usercopy:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_HARDENED_USERCOPY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_hardened_usercopy_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_hardened_usercopy_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_hardened_usercopy_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_HARDENED_USERCOPY_FALLBACK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_hardened_usercopy_fallback_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_hardened_usercopy_fallback_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_hardened_usercopy_fallback_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_hibernation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_HIBERNATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_hibernation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_hibernation_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_ia32_emulation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_IA32_EMULATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_ia32_emulation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_ia32_emulation_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_ipv6:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_IPV6="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_ipv6_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_ipv6_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_kexec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_KEXEC="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_kexec_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_kexec_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_kexec_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_ptys:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_PTYS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_ptys_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_legacy_ptys_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_EMULATE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_emulate_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_vsyscall_emulate_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_legacy_vsyscall_emulate_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_NONE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_none_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_vsyscall_none_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_legacy_vsyscall_none_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_LEGACY_VSYSCALL_XONLY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_legacy_vsyscall_xonly_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_legacy_vsyscall_xonly_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_legacy_vsyscall_xonly_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODIFY_LDT_SYSCALL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_modify_ldt_syscall_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_modify_ldt_syscall_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_modify_ldt_syscall_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_module_sig_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_all:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_ALL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_all_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_module_sig_all_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_force:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_FORCE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_force_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_module_sig_force_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_hash:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_HASH="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_hash_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_module_sig_hash_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_key:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_KEY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_key_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_module_sig_key_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_module_sig_sha512:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_MODULE_SIG_SHA512="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_module_sig_sha512_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_module_sig_sha512_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_POISONING="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_poisoning_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_page_poisoning_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_POISONING_NO_SANITY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_no_sanity_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_page_poisoning_no_sanity_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_POISONING_ZERO="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_poisoning_zero_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_page_poisoning_zero_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_page_table_isolation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PAGE_TABLE_ISOLATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_page_table_isolation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_page_table_isolation_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_panic_on_oops:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PANIC_ON_OOPS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_panic_on_oops_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_panic_on_oops_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_panic_timeout:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PANIC_TIMEOUT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_panic_timeout_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_panic_timeout_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_proc_kcore:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_PROC_KCORE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_proc_kcore_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_proc_kcore_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_randomize_base:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_RANDOMIZE_BASE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_randomize_base_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_randomize_base_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_randomize_memory:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_RANDOMIZE_MEMORY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_randomize_memory_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_randomize_memory_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_refcount_full:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_REFCOUNT_FULL="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_refcount_full_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_refcount_full_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_refcount_full_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_retpoline:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_RETPOLINE="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_retpoline_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_retpoline_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SCHED_STACK_END_CHECK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_sched_stack_end_check_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_sched_stack_end_check_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_sched_stack_end_check_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_seccomp:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECCOMP="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_seccomp_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_seccomp_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_seccomp_filter:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECCOMP_FILTER="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_seccomp_filter_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_seccomp_filter_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_security_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY_DMESG_RESTRICT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_dmesg_restrict_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_security_dmesg_restrict_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security_writable_hooks:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY_WRITABLE_HOOKS="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_writable_hooks_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_security_writable_hooks_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_security_yama:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SECURITY_YAMA="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_security_yama_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_security_yama_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLAB_FREELIST_HARDENED="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slab_freelist_hardened_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slab_freelist_hardened_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_slab_freelist_hardened_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_freelist_random:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLAB_FREELIST_RANDOM="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slab_freelist_random_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slab_freelist_random_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_slab_freelist_random_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slab_merge_default:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLAB_MERGE_DEFAULT="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slab_merge_default_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slab_merge_default_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_slab_merge_default_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_slub_debug:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SLUB_DEBUG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_slub_debug_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_slub_debug_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_stackprotector:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STACKPROTECTOR="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_stackprotector_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_stackprotector_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_stackprotector_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_stackprotector_strong:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STACKPROTECTOR_STRONG="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_stackprotector_strong_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_stackprotector_strong_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_stackprotector_strong_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STRICT_KERNEL_RWX="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_strict_kernel_rwx_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_strict_kernel_rwx_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_strict_kernel_rwx_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_strict_module_rwx:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_STRICT_MODULE_RWX="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_strict_module_rwx_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_strict_module_rwx_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_strict_module_rwx_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_syn_cookies:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_SYN_COOKIES="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_syn_cookies_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_syn_cookies_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_UNMAP_KERNEL_AT_EL0="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_unmap_kernel_at_el0_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_unmap_kernel_at_el0_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_vmap_stack:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_VMAP_STACK="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_vmap_stack_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_vmap_stack_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_vmap_stack_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/config-.*$</ind:filepath>
          <ind:pattern operation="pattern match">^CONFIG_X86_VSYSCALL_EMULATION="?(.*?)"?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_kernel_config_x86_vsyscall_emulation_count:obj:1" version="1">
          <ind:var_ref>oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object id="oval:ssg-object_kernel_config_x86_vsyscall_emulation_files:obj:1" version="1" comment="Collect the kernel config files">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^config-.*$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_disabled:obj:1" version="1" comment="kernel module atm disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_atm_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_blacklisted:obj:1" version="1" comment="kernel module atm blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_atm_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+atm$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_bluetooth_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_blacklisted:obj:1" version="1" comment="kernel module bluetooth blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_bluetooth_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+bluetooth$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_disabled:obj:1" version="1" comment="kernel module can disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_can_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_blacklisted:obj:1" version="1" comment="kernel module can blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_can_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+can$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_cramfs_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_blacklisted:obj:1" version="1" comment="kernel module cramfs blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_cramfs_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+cramfs$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_dccp_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_blacklisted:obj:1" version="1" comment="kernel module dccp blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_dccp_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+dccp$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1" version="1" comment="kernel module firewire-core disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_firewire-core_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_blacklisted:obj:1" version="1" comment="kernel module firewire-core blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_firewire-core_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+firewire-core$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_disabled:obj:1" version="1" comment="kernel module rds disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_rds_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_blacklisted:obj:1" version="1" comment="kernel module rds blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_rds_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+rds$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_disabled:obj:1" version="1" comment="kernel module sctp disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_sctp_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_blacklisted:obj:1" version="1" comment="kernel module sctp blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_sctp_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+sctp$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_squashfs_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_blacklisted:obj:1" version="1" comment="kernel module squashfs blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_squashfs_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+squashfs$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" comment="kernel module tipc disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_tipc_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_blacklisted:obj:1" version="1" comment="kernel module tipc blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_tipc_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+tipc$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_udf_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_blacklisted:obj:1" version="1" comment="kernel module udf blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_udf_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+udf$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_usb-storage_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_blacklisted:obj:1" version="1" comment="kernel module usb-storage blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_usb-storage_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+usb-storage$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_uvcvideo_disabled:obj:1" version="1" comment="kernel module uvcvideo disabled">
          <ind:path var_ref="oval:ssg-var_kernel_module_uvcvideo_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+uvcvideo\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_uvcvideo_blacklisted:obj:1" version="1" comment="kernel module uvcvideo blacklisted">
          <ind:path var_ref="oval:ssg-var_kernel_module_uvcvideo_paths:var:1" var_check="at least one"/>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^blacklist\s+uvcvideo$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_boot_efi_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/boot/efi</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_boot_efi_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/boot/efi[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_boot_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/boot[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_noexec_optional:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_boot_partition_noexec_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/boot[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_boot_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/boot[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_dev_shm_partition_nodev_expected:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_dev_shm_partition_nodev_expected_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/dev/shm[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_dev_shm_partition_noexec_expected:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_dev_shm_partition_noexec_expected_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/dev/shm[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_dev_shm_partition_nosuid_expected:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_dev_shm_partition_nosuid_expected_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/dev/shm[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_home_partitions_mount_points_grpquota:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_grpquota_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_home_partition_all_partitions_grpquota:obj:1" version="1">
          <linux:mount_point operation="not equal">/</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_home_partitions_grpquota:obj:1" version="1">
          <linux:mount_point operation="equals" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_grpquota:var:1"/>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_home_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_home_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/home[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_home_partitions_mount_points_noexec:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_noexec_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_home_partition_all_partitions_noexec:obj:1" version="1">
          <linux:mount_point operation="not equal">/</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_home_partitions_noexec:obj:1" version="1">
          <linux:mount_point operation="equals" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_noexec:var:1"/>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_home_partitions_mount_points_nosuid:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_nosuid_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_home_partition_all_partitions_nosuid:obj:1" version="1">
          <linux:mount_point operation="not equal">/</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_home_partitions_nosuid:obj:1" version="1">
          <linux:mount_point operation="equals" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_nosuid:var:1"/>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_home_partitions_mount_points_usrquota:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_usrquota_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_home_partition_all_partitions_usrquota:obj:1" version="1">
          <linux:mount_point operation="not equal">/</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_home_partitions_usrquota:obj:1" version="1">
          <linux:mount_point operation="equals" var_check="at least one" var_ref="oval:ssg-var_home_partitions_mount_points_usrquota:var:1"/>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nfs_sec_krb5_krb5i_krb5p_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[?[\.\w:-]+\]?[:=][/\w-]+\s+[/\w\\-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="not equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nfs_nodev_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[?[\.\w:-]+\]?[:=][/\w-]+\s+[/\w\\-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="not equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nfs_noexec_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[?[\.\w:-]+\]?[:=][/\w-]+\s+[/\w\\-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="not equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nfs_nosuid_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[?[\.\w:-]+\]?[:=][/\w-]+\s+[/\w\\-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="not equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_opt_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/opt</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_opt_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/opt[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_srv_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_srv_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/srv[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_tmp_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_tmp_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_tmp_partition_noexec_optional:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_tmp_partition_noexec_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_tmp_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_tmp_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_log_audit_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_log_audit_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/log/audit[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_log_audit_partition_noexec_optional:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_log_audit_partition_noexec_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/log/audit[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_log_audit_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_log_audit_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/log/audit[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_log_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_log_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/log[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_log_partition_noexec_optional:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_log_partition_noexec_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/log[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_log_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_log_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/log[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_partition_noexec_optional:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_partition_noexec_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_tmp_partition_nodev_optional:obj:1" version="1">
          <linux:mount_point>/var/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_tmp_partition_nodev_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_tmp_partition_noexec_optional:obj:1" version="1">
          <linux:mount_point>/var/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_tmp_partition_noexec_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_var_tmp_partition_nosuid_optional:obj:1" version="1">
          <linux:mount_point>/var/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_var_tmp_partition_nosuid_optional_in_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?!#)[\S]+[\s]+/var/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_aide_installed:obj:1" version="1">
          <linux:name>aide</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1" version="1">
          <linux:name>audispd-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1">
          <linux:name>bind</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cronie_installed:obj:1" version="1">
          <linux:name>cronie</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_crypto-policies_installed:obj:1" version="1">
          <linux:name>crypto-policies</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cryptsetup_installed:obj:1" version="1">
          <linux:name>cryptsetup</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cyrus-imapd_removed:obj:1" version="1">
          <linux:name>cyrus-imapd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dconf_installed:obj:1" version="1">
          <linux:name>dconf</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dhcp_removed:obj:1" version="1">
          <linux:name>dhcp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1" version="1">
          <linux:name>dnf-automatic</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dovecot_removed:obj:1" version="1">
          <linux:name>dovecot</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_fapolicyd_installed:obj:1" version="1">
          <linux:name>fapolicyd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_firewalld_installed:obj:1" version="1">
          <linux:name>firewalld</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_ftp_removed:obj:1" version="1">
          <linux:name>ftp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1" version="1">
          <linux:name>gnutls-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gssproxy_removed:obj:1" version="1">
          <linux:name>gssproxy</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1" version="1">
          <linux:name>inetutils-telnetd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_iprutils_removed:obj:1" version="1">
          <linux:name>iprutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1">
          <linux:name>libreswan</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libselinux_installed:obj:1" version="1">
          <linux:name>libselinux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_logrotate_installed:obj:1" version="1">
          <linux:name>logrotate</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_McAfeeTP_installed:obj:1" version="1">
          <linux:name>McAfeeTP</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_net-snmp_removed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nftables_installed:obj:1" version="1">
          <linux:name>nftables</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nis_removed:obj:1" version="1">
          <linux:name>nis</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nss-tools_installed:obj:1" version="1">
          <linux:name>nss-tools</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_opensc_installed:obj:1" version="1">
          <linux:name>opensc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1" version="1">
          <linux:name>openscap-scanner</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-clients_installed:obj:1" version="1">
          <linux:name>openssh-clients</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_installed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_removed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1" version="1">
          <linux:name>pcsc-lite</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_policycoreutils-python-utils_installed:obj:1" version="1">
          <linux:name>policycoreutils-python-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_policycoreutils_installed:obj:1" version="1">
          <linux:name>policycoreutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_quagga_removed:obj:1" version="1">
          <linux:name>quagga</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rear_installed:obj:1" version="1">
          <linux:name>rear</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rng-tools_installed:obj:1" version="1">
          <linux:name>rng-tools</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsh-server_removed:obj:1" version="1">
          <linux:name>rsh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsh_removed:obj:1" version="1">
          <linux:name>rsh</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1" version="1">
          <linux:name>rsyslog-gnutls</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_s-nail_installed:obj:1" version="1">
          <linux:name>s-nail</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1" version="1">
          <linux:name>scap-security-guide</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sendmail_removed:obj:1" version="1">
          <linux:name>sendmail</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1" version="1">
          <linux:name>setroubleshoot-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1" version="1">
          <linux:name>setroubleshoot-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1" version="1">
          <linux:name>setroubleshoot</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_squid_removed:obj:1" version="1">
          <linux:name>squid</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sssd_installed:obj:1" version="1">
          <linux:name>sssd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_syslog-ng_installed:obj:1" version="1">
          <linux:name>syslog-ng</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_talk-server_removed:obj:1" version="1">
          <linux:name>talk-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_talk_removed:obj:1" version="1">
          <linux:name>talk</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnet-server_removed:obj:1" version="1">
          <linux:name>telnet-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnet_removed:obj:1" version="1">
          <linux:name>telnet</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1" version="1">
          <linux:name>telnetd-ssl</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnetd_removed:obj:1" version="1">
          <linux:name>telnetd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tftp-server_removed:obj:1" version="1">
          <linux:name>tftp-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tftp_removed:obj:1" version="1">
          <linux:name>tftp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tuned_removed:obj:1" version="1">
          <linux:name>tuned</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_removed:obj:1" version="1">
          <linux:name>vsftpd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1" version="1">
          <linux:name>xorg-x11-server-common</linux:name>
        </linux:rpminfo_object>
        <linux:partition_object id="oval:ssg-object_mountdev_shm_own_partition:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mounthome_own_partition:obj:1" version="1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountsrv_own_partition:obj:1" version="1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mounttmp_own_partition:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_own_partition:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_log_own_partition:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_log_audit_own_partition:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_tmp_own_partition:obj:1" version="1">
          <linux:mount_point>/var/tmp</linux:mount_point>
        </linux:partition_object>
        <unix:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_0:obj:1" version="1" comment="/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_0:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_1:obj:1" version="1" comment="/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_1:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_2:obj:1" version="1" comment="/usr/lib/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_2:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_file_groupownerroot_permissions_syslibrary_files_3:obj:1" version="1" comment="/usr/lib64/">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path>/usr/lib64</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_3:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_files_groupownership_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig and include() statements values.">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_groupownership_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable.">
          <ind:var_ref>oval:ssg-var_rsyslog_files_groupownership_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_groupownership_syslog_config:obj:1" version="1" comment="Make variable object from local variable.">
          <ind:var_ref>oval:ssg-var_rsyslog_files_groupownership_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_groupownership_all_conf_files:obj:1" version="1" comment="Variable containing all rsyslog configuration files.">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rsyslog_files_groupownership_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rsyslog_files_groupownership_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_files_groupownership_log_files_paths:obj:1" version="1" comment="All rsyslog log files collected from rsyslog configuration files.">
          <ind:filepath operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_rsyslog_files_groupownership_all_conf_files:var:1"/>
          <ind:pattern operation="pattern match">^\s*[^(\s|#|\$)]+\s+.*(?:\bFile="|\s|\/|-)(\/[^:;\s"]+).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_rsyslog_files_groupownership_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership_groupowner:obj:1" version="1" comment="All system log files collected from rsyslog configuration files">
          <unix:filepath datatype="string" var_check="at least one" var_ref="oval:ssg-var_rsyslog_files_groupownership_log_files_paths:var:1"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_files_groupownership_groupowner_gid:obj:1" version="1" comment="GID of group root">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_files_ownership_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig and include() statements values.">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_ownership_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable.">
          <ind:var_ref>oval:ssg-var_rsyslog_files_ownership_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_ownership_syslog_config:obj:1" version="1" comment="Make variable object from local variable.">
          <ind:var_ref>oval:ssg-var_rsyslog_files_ownership_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_ownership_all_conf_files:obj:1" version="1" comment="Variable containing all rsyslog configuration files.">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rsyslog_files_ownership_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rsyslog_files_ownership_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_files_ownership_log_files_paths:obj:1" version="1" comment="All rsyslog log files collected from rsyslog configuration files.">
          <ind:filepath operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_rsyslog_files_ownership_all_conf_files:var:1"/>
          <ind:pattern operation="pattern match">^\s*[^(\s|#|\$)]+\s+.*(?:\bFile="|\s|\/|-)(\/[^:;\s"]+).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_rsyslog_files_ownership_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_ownership_owner:obj:1" version="1" comment="All system log files collected from rsyslog configuration files">
          <unix:filepath datatype="string" var_check="at least one" var_ref="oval:ssg-var_rsyslog_files_ownership_log_files_paths:var:1"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_files_ownership_owner_uid:obj:1" version="1" comment="UID of user root">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^root:\w+:(\w+):.*</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_files_permissions_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig and include() statements values.">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_permissions_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable.">
          <ind:var_ref>oval:ssg-var_rsyslog_files_permissions_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_permissions_syslog_config:obj:1" version="1" comment="Make variable object from local variable.">
          <ind:var_ref>oval:ssg-var_rsyslog_files_permissions_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rsyslog_files_permissions_all_conf_files:obj:1" version="1" comment="Variable containing all rsyslog configuration files.">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rsyslog_files_permissions_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rsyslog_files_permissions_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_files_permissions_log_files_paths:obj:1" version="1" comment="All rsyslog log files collected from rsyslog configuration files.">
          <ind:filepath operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_rsyslog_files_permissions_all_conf_files:var:1"/>
          <ind:pattern operation="pattern match">^\s*[^(\s|#|\$)]+\s+.*(?:\bFile="|\s|\/|-)(\/[^:;\s"]+).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_rsyslog_files_permissions_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_permissions_permissions:obj:1" version="1" comment="All system log files collected from rsyslog configuration files">
          <unix:filepath datatype="string" var_check="at least one" var_ref="oval:ssg-var_rsyslog_files_permissions_log_files_paths:var:1"/>
        </unix:file_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_auditadm_exec_content:obj:1" version="1">
          <linux:name>auditadm_exec_content</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_authlogin_nsswitch_use_ldap:obj:1" version="1">
          <linux:name>authlogin_nsswitch_use_ldap</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_authlogin_radius:obj:1" version="1">
          <linux:name>authlogin_radius</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_deny_execmem:obj:1" version="1">
          <linux:name>deny_execmem</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_kerberos_enabled:obj:1" version="1">
          <linux:name>kerberos_enabled</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_polyinstantiation_enabled:obj:1" version="1">
          <linux:name>polyinstantiation_enabled</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_secure_mode_insmod:obj:1" version="1">
          <linux:name>secure_mode_insmod</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_selinuxuser_execheap:obj:1" version="1">
          <linux:name>selinuxuser_execheap</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_selinuxuser_execmod:obj:1" version="1">
          <linux:name>selinuxuser_execmod</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_selinuxuser_execstack:obj:1" version="1">
          <linux:name>selinuxuser_execstack</linux:name>
        </linux:selinuxboolean_object>
        <linux:selinuxboolean_object id="oval:ssg-object_sebool_ssh_sysadm_login:obj:1" version="1">
          <linux:name>ssh_sysadm_login</linux:name>
        </linux:selinuxboolean_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_atd_disabled_atd:obj:1" version="1" comment="Retrieve the ActiveState property of atd">
          <linux:unit operation="pattern match">^atd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_atd_disabled_atd:obj:1" version="1" comment="Retrieve the LoadState property of atd">
          <linux:unit operation="pattern match">^atd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_atd_disabled_test_service_atd_package_at_removed:obj:1" version="1">
          <linux:name>at</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_auditd:obj:1" version="1" comment="Retrieve the ActiveState property of auditd">
          <linux:unit operation="pattern match">^auditd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_autofs_disabled_autofs:obj:1" version="1" comment="Retrieve the ActiveState property of autofs">
          <linux:unit operation="pattern match">^autofs\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_autofs_disabled_autofs:obj:1" version="1" comment="Retrieve the LoadState property of autofs">
          <linux:unit operation="pattern match">^autofs\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_autofs_disabled_test_service_autofs_package_autofs_removed:obj:1" version="1">
          <linux:name>autofs</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_avahi-daemon_disabled_avahi-daemon:obj:1" version="1" comment="Retrieve the ActiveState property of avahi-daemon">
          <linux:unit operation="pattern match">^avahi-daemon\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_avahi-daemon_disabled_avahi-daemon:obj:1" version="1" comment="Retrieve the LoadState property of avahi-daemon">
          <linux:unit operation="pattern match">^avahi-daemon\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_avahi-daemon_disabled_test_service_avahi-daemon_package_avahi_removed:obj:1" version="1">
          <linux:name>avahi</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_chronyd:obj:1" version="1" comment="Retrieve the ActiveState property of chronyd">
          <linux:unit operation="pattern match">^chronyd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_crond:obj:1" version="1" comment="Retrieve the ActiveState property of crond">
          <linux:unit operation="pattern match">^crond\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1" version="1">
          <linux:name>cronie</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_debug-shell_disabled_debug-shell:obj:1" version="1" comment="Retrieve the ActiveState property of debug-shell">
          <linux:unit operation="pattern match">^debug-shell\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_debug-shell_disabled_debug-shell:obj:1" version="1" comment="Retrieve the LoadState property of debug-shell">
          <linux:unit operation="pattern match">^debug-shell\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_debug-shell_disabled_test_service_debug-shell_package_systemd_removed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_fapolicyd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_fapolicyd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_fapolicyd:obj:1" version="1" comment="Retrieve the ActiveState property of fapolicyd">
          <linux:unit operation="pattern match">^fapolicyd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_fapolicyd_package_fapolicyd_installed:obj:1" version="1">
          <linux:name>fapolicyd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_firewalld:obj:1" version="1" comment="Retrieve the ActiveState property of firewalld">
          <linux:unit operation="pattern match">^firewalld\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1" version="1">
          <linux:name>firewalld</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_iptables:obj:1" version="1" comment="Retrieve the ActiveState property of iptables">
          <linux:unit operation="pattern match">^iptables\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_kdump_disabled_kdump:obj:1" version="1" comment="Retrieve the ActiveState property of kdump">
          <linux:unit operation="pattern match">^kdump\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_kdump_disabled_kdump:obj:1" version="1" comment="Retrieve the LoadState property of kdump">
          <linux:unit operation="pattern match">^kdump\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_kdump_disabled_test_service_kdump_package_kexec-tools_removed:obj:1" version="1">
          <linux:name>kexec-tools</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_nftables_disabled_nftables:obj:1" version="1" comment="Retrieve the ActiveState property of nftables">
          <linux:unit operation="pattern match">^nftables\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_nftables_disabled_nftables:obj:1" version="1" comment="Retrieve the LoadState property of nftables">
          <linux:unit operation="pattern match">^nftables\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_nftables_disabled_test_service_nftables_package_nftables_removed:obj:1" version="1">
          <linux:name>nftables</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_oddjobd_disabled_oddjobd:obj:1" version="1" comment="Retrieve the ActiveState property of oddjobd">
          <linux:unit operation="pattern match">^oddjobd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_oddjobd_disabled_oddjobd:obj:1" version="1" comment="Retrieve the LoadState property of oddjobd">
          <linux:unit operation="pattern match">^oddjobd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_oddjobd_disabled_test_service_oddjobd_package_oddjob_removed:obj:1" version="1">
          <linux:name>oddjob</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_pcscd:obj:1" version="1" comment="Retrieve the ActiveState property of pcscd">
          <linux:unit operation="pattern match">^pcscd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1" version="1">
          <linux:name>pcsc-lite</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_postfix_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_postfix_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_postfix:obj:1" version="1" comment="Retrieve the ActiveState property of postfix">
          <linux:unit operation="pattern match">^postfix\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_postfix_package_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_rdisc_disabled_rdisc:obj:1" version="1" comment="Retrieve the ActiveState property of rdisc">
          <linux:unit operation="pattern match">^rdisc\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_rdisc_disabled_rdisc:obj:1" version="1" comment="Retrieve the LoadState property of rdisc">
          <linux:unit operation="pattern match">^rdisc\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_rdisc_disabled_test_service_rdisc_package_iputils_removed:obj:1" version="1">
          <linux:name>iputils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_rlogin_disabled_rlogin:obj:1" version="1" comment="Retrieve the ActiveState property of rlogin">
          <linux:unit operation="pattern match">^rlogin\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_rlogin_disabled_rlogin:obj:1" version="1" comment="Retrieve the LoadState property of rlogin">
          <linux:unit operation="pattern match">^rlogin\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_rlogin_disabled_test_service_rlogin_package_rsh-server_removed:obj:1" version="1">
          <linux:name>rsh-server</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_rngd:obj:1" version="1" comment="Retrieve the ActiveState property of rngd">
          <linux:unit operation="pattern match">^rngd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1" version="1">
          <linux:name>rng-tools</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_rsyncd_disabled_rsyncd:obj:1" version="1" comment="Retrieve the ActiveState property of rsyncd">
          <linux:unit operation="pattern match">^rsyncd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_rsyncd_disabled_rsyncd:obj:1" version="1" comment="Retrieve the LoadState property of rsyncd">
          <linux:unit operation="pattern match">^rsyncd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_rsyncd_disabled_test_service_rsyncd_package_rsync-daemon_removed:obj:1" version="1">
          <linux:name>rsync-daemon</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_rsyslog:obj:1" version="1" comment="Retrieve the ActiveState property of rsyslog">
          <linux:unit operation="pattern match">^rsyslog\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_snmpd_disabled_snmpd:obj:1" version="1" comment="Retrieve the ActiveState property of snmpd">
          <linux:unit operation="pattern match">^snmpd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_snmpd_disabled_snmpd:obj:1" version="1" comment="Retrieve the LoadState property of snmpd">
          <linux:unit operation="pattern match">^snmpd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_snmpd_disabled_test_service_snmpd_package_net-snmp_removed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_squid_disabled_squid:obj:1" version="1" comment="Retrieve the ActiveState property of squid">
          <linux:unit operation="pattern match">^squid\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_squid_disabled_squid:obj:1" version="1" comment="Retrieve the LoadState property of squid">
          <linux:unit operation="pattern match">^squid\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_squid_disabled_test_service_squid_package_squid_removed:obj:1" version="1">
          <linux:name>squid</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_sshd_disabled_sshd:obj:1" version="1" comment="Retrieve the ActiveState property of sshd">
          <linux:unit operation="pattern match">^sshd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_sshd_disabled_sshd:obj:1" version="1" comment="Retrieve the LoadState property of sshd">
          <linux:unit operation="pattern match">^sshd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_sshd_disabled_test_service_sshd_package_openssh-server_removed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sshd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sshd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_sshd:obj:1" version="1" comment="Retrieve the ActiveState property of sshd">
          <linux:unit operation="pattern match">^sshd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_sshd_package_openssh-server_installed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sssd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sssd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_sssd:obj:1" version="1" comment="Retrieve the ActiveState property of sssd">
          <linux:unit operation="pattern match">^sssd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_sssd_package_sssd-common_installed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslog-ng_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslog-ng_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_syslog-ng:obj:1" version="1" comment="Retrieve the ActiveState property of syslog-ng">
          <linux:unit operation="pattern match">^syslog-ng\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_syslog-ng_package_syslog-ng_installed:obj:1" version="1">
          <linux:name>syslog-ng</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_socket_loadstate_is_masked_systemd-coredump:obj:1" version="1" comment="Retrieve the LoadState property of systemd-coredump.socket">
          <linux:unit operation="pattern match">^systemd-coredump.socket$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_systemd-journald_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_systemd-journald_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_systemd-journald:obj:1" version="1" comment="Retrieve the ActiveState property of systemd-journald">
          <linux:unit operation="pattern match">^systemd-journald\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_systemd-journald_package_systemd_installed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_telnet_disabled_telnet:obj:1" version="1" comment="Retrieve the ActiveState property of telnet">
          <linux:unit operation="pattern match">^telnet\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_telnet_disabled_telnet:obj:1" version="1" comment="Retrieve the LoadState property of telnet">
          <linux:unit operation="pattern match">^telnet\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_telnet_disabled_test_service_telnet_package_telnet-server_removed:obj:1" version="1">
          <linux:name>telnet-server</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ufw_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ufw_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ufw:obj:1" version="1" comment="Retrieve the ActiveState property of ufw">
          <linux:unit operation="pattern match">^ufw\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ufw_package_ufw_installed:obj:1" version="1">
          <linux:name>ufw</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_usbguard:obj:1" version="1" comment="Retrieve the ActiveState property of usbguard">
          <linux:unit operation="pattern match">^usbguard\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_set_firewalld_default_zone:obj:1" version="1">
          <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*DefaultZone=drop[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_allow_only_protocol2:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_allow_only_protocol2_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_allow_only_protocol2:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Protocol(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_allow_only_protocol2:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Protocol(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_allow_only_protocol2:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_allow_only_protocol2:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_allow_only_protocol2_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_compression:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_compression:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_compression:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_compression:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_compression_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_empty_passwords:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_empty_passwords:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_empty_passwords:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_empty_passwords:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_empty_passwords_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_gssapi_auth:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_gssapi_auth:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_gssapi_auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_gssapi_auth_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_kerb_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_kerb_auth:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_kerb_auth:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_kerb_auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_kerb_auth_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_pubkey_auth:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_pubkey_auth:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_pubkey_auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_pubkey_auth_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_rhosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_rhosts:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_rhosts:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_rhosts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_rhosts_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_rhosts_rsa:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_rhosts_rsa:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)RhostsRSAAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)RhostsRSAAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_rhosts_rsa:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_rhosts_rsa_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_root_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_root_login:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_root_login:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_root_login:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_root_login_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_root_password_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_root_password_login:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_root_password_login:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_root_password_login:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_root_password_login_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_tcp_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_tcp_forwarding:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_tcp_forwarding:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_tcp_forwarding_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_user_known_hosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_user_known_hosts:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_user_known_hosts:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_user_known_hosts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_user_known_hosts_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_disable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_disable_x11_forwarding:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_disable_x11_forwarding:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_x11_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_disable_x11_forwarding_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_do_not_permit_user_env:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_do_not_permit_user_env:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_do_not_permit_user_env:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_do_not_permit_user_env:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_do_not_permit_user_env_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_gssapi_auth:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_gssapi_auth:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_gssapi_auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_gssapi_auth_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_pam:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pam_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_pam:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pam:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_pam:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_pam:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_pam_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pubkey_auth_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_pubkey_auth:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_pubkey_auth:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_pubkey_auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_pubkey_auth_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_strictmodes:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_strictmodes:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_strictmodes:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_strictmodes:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_strictmodes_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_warning_banner:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_warning_banner:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_warning_banner:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_warning_banner:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_warning_banner_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_warning_banner_net:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_net_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_warning_banner_net:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_net:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_warning_banner_net:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_warning_banner_net:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_warning_banner_net_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_enable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_enable_x11_forwarding:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_enable_x11_forwarding:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_x11_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_enable_x11_forwarding_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_includes_config_files:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_print_last_log:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_print_last_log:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_print_last_log:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_print_last_log:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_print_last_log_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_set_keepalive:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_set_keepalive:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_keepalive:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_keepalive:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_keepalive_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_set_keepalive_0:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_set_keepalive_0:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_keepalive_0:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_keepalive_0:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_keepalive_0_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_set_loglevel_info:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_set_loglevel_info:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_loglevel_info:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_loglevel_info:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_loglevel_info_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_set_loglevel_verbose:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_set_loglevel_verbose:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_set_loglevel_verbose:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_loglevel_verbose:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_set_loglevel_verbose_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_use_priv_separation:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_use_priv_separation:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_use_priv_separation:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_use_priv_separation:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_use_priv_separation_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_include_value_sshd_x11_use_localhost:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)include(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_sshd_included_files:obj:1" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_sshd_config_included_files_sshd_x11_use_localhost:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_collection_obj_sshd_x11_use_localhost:obj:1" version="1" comment="All confs collection">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-obj_sshd_x11_use_localhost:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-obj_sshd_x11_use_localhost_sshd_included_files:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_certmap:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[certmap\/.+\/.+\][\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults[\s]*[^!]\bnoexec.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_requiretty_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults[\s]*[^!]\brequiretty.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_use_pty_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults[\s]*[^!]\buse_pty.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logfile_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults[\s]*[^!]\blogfile\s*=\s*(?:"?([^",\s]+)"?).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_fifos_runtime:obj:1" version="1">
          <unix:name>fs.protected_fifos</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_fifos:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_fs_protected_fifos:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_fs_protected_fifos:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_fifos:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_fs_protected_fifos:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_fifos:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_fifos:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_fifos[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_hardlinks_runtime:obj:1" version="1">
          <unix:name>fs.protected_hardlinks</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_fs_protected_hardlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_regular_runtime:obj:1" version="1">
          <unix:name>fs.protected_regular</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_regular:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_fs_protected_regular:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_fs_protected_regular:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_regular:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_fs_protected_regular:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_regular:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_regular:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_regular[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_fs_protected_symlinks_runtime:obj:1" version="1">
          <unix:name>fs.protected_symlinks</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_protected_symlinks:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_fs_protected_symlinks:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_fs_suid_dumpable_runtime:obj:1" version="1">
          <unix:name>fs.suid_dumpable</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_fs_suid_dumpable:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_fs_suid_dumpable:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_core_pattern_runtime:obj:1" version="1">
          <unix:name>kernel.core_pattern</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_core_pattern:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_core_uses_pid_runtime:obj:1" version="1">
          <unix:name>kernel.core_uses_pid</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_core_uses_pid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_core_uses_pid:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_uses_pid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_dmesg_restrict_runtime:obj:1" version="1">
          <unix:name>kernel.dmesg_restrict</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_dmesg_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_kexec_load_disabled_runtime:obj:1" version="1">
          <unix:name>kernel.kexec_load_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_kexec_load_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_kptr_restrict_runtime:obj:1" version="1">
          <unix:name>kernel.kptr_restrict</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_kptr_restrict:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_modules_disabled_runtime:obj:1" version="1">
          <unix:name>kernel.modules_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_modules_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_modules_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_panic_on_oops_runtime:obj:1" version="1">
          <unix:name>kernel.panic_on_oops</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_panic_on_oops:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_panic_on_oops:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.panic_on_oops[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_cpu_time_max_percent_runtime:obj:1" version="1">
          <unix:name>kernel.perf_cpu_time_max_percent</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_event_max_sample_rate_runtime:obj:1" version="1">
          <unix:name>kernel.perf_event_max_sample_rate</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_perf_event_paranoid_runtime:obj:1" version="1">
          <unix:name>kernel.perf_event_paranoid</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_event_paranoid:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_pid_max_runtime:obj:1" version="1">
          <unix:name>kernel.pid_max</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_pid_max:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_pid_max:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_randomize_va_space_runtime:obj:1" version="1">
          <unix:name>kernel.randomize_va_space</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_randomize_va_space:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_sysrq_runtime:obj:1" version="1">
          <unix:name>kernel.sysrq</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_sysrq:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_sysrq:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_unprivileged_bpf_disabled_runtime:obj:1" version="1">
          <unix:name>kernel.unprivileged_bpf_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime:obj:1" version="1">
          <unix:name>kernel.unprivileged_bpf_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_yama_ptrace_scope_runtime:obj:1" version="1">
          <unix:name>kernel.yama.ptrace_scope</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_core_bpf_jit_harden_runtime:obj:1" version="1">
          <unix:name>net.core.bpf_jit_harden</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_core_bpf_jit_harden:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_local_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_local</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_local:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_local[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_source_route_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_arp_filter_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.arp_filter</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_arp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_arp_ignore_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.arp_ignore</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.arp_ignore[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.drop_gratuitous_arp</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.drop_gratuitous_arp[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_forwarding_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.forwarding</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_forwarding:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_log_martians_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.log_martians</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_route_localnet_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.route_localnet</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_route_localnet:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.route_localnet[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_rp_filter_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.rp_filter</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_secure_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_send_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.send_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_shared_media_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.shared_media</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_all_shared_media:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_source_route_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_log_martians_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.log_martians</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_rp_filter_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.rp_filter</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_secure_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_send_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.send_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_shared_media_runtime:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.shared_media</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_conf_default_shared_media:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.shared_media[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:obj:1" version="1">
          <unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:obj:1" version="1">
          <unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_ip_forward_runtime:obj:1" version="1">
          <unix:name>net.ipv4.ip_forward</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_ip_forward:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_ip_local_port_range_runtime:obj:1" version="1">
          <unix:name>net.ipv4.ip_local_port_range</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_tcp_rfc1337_runtime:obj:1" version="1">
          <unix:name>net.ipv4.tcp_rfc1337</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_rfc1337[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_rfc1337[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_rfc1337[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_rfc1337[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_tcp_rfc1337:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_rfc1337[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_tcp_syncookies_runtime:obj:1" version="1">
          <unix:name>net.ipv4.tcp_syncookies</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.tcp_syncookies[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_defrtr</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_pinfo</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_rtr_pref</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_source_route_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_autoconf_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.autoconf</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.disable_ipv6</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_forwarding_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.forwarding</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_max_addresses_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.max_addresses</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_router_solicitations_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.router_solicitations</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_defrtr</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_pinfo</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_rtr_pref</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_redirects_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_source_route_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_autoconf_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.autoconf</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_disable_ipv6_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.disable_ipv6</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_max_addresses_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.max_addresses</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_router_solicitations_runtime:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.router_solicitations</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_user_max_user_namespaces_runtime:obj:1" version="1">
          <unix:name>user.max_user_namespaces</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_user_max_user_namespaces:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_user_max_user_namespaces:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_vm_mmap_min_addr_runtime:obj:1" version="1">
          <unix:name>vm.mmap_min_addr</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_user_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_lib_sysctls_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_usr_local_sysctls_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_lib_sysctls_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctls_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctls_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_sysctl_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_etc_sysctld_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_usr_local_sysctls_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_static_usr_local_lib_sysctld_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_static_run_sysctld_sysctl_vm_mmap_min_addr:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_local_lib_sysctld_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/usr/local/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_tmp_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_mount_running_tmp:obj:1" version="1" comment="Retrieve the ActiveState property of tmp">
          <linux:unit operation="equals">tmp.mount</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_timer_running_dnf-automatic:obj:1" version="1" comment="Retrieve the ActiveState property of dnf-automatic">
          <linux:unit operation="pattern match">dnf-automatic\.timer</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_logrotate_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_timer_running_logrotate:obj:1" version="1" comment="Retrieve the ActiveState property of logrotate">
          <linux:unit operation="pattern match">logrotate\.timer</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1">
          <ind:filepath var_ref="oval:ssg-var_pam_pwquality_config_path:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_auditctl:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_augenrules:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
          <ind:pattern operation="pattern match">^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_file:obj:1" version="1">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(log_file\s*=\s*.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" version="1" comment="log_group = root">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_is_set:obj:1" version="1" comment="log_group is set">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_kernel_installed:obj:1" version="1">
          <linux:name>kernel</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_rpm_ostree_installed:obj:1" version="1">
          <linux:name>rpm-ostree</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_bootc_installed:obj:1" version="1">
          <linux:name>bootc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_openshift_kubelet_removed:obj:1" version="1">
          <linux:name>openshift-kubelet</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_chronyd_multiple_servers:obj:1" version="1" comment="Ensure more than one chronyd NTP server is set">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol9_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
          <linux:name>redhat-release-virtualization-host</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_suma_4:obj:1" version="1">
          <linux:name>SUSE-Manager-Server-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle_hpc:obj:1" version="1">
          <linux:name>SLE_HPC-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_slmicro5_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_slmicroos5:obj:1" version="1">
          <linux:name>SUSE-MicroOS-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_slmicro5:obj:1" version="1">
          <linux:name>SLE-Micro-release</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-obj_lsb:obj:1" version="1" comment="check /etc/lsb-release file">
          <unix:filepath>/etc/lsb-release</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_sshd_not_required:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_sshd_required:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_sshd_requirement_unknown:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_aarch_64:obj:1" version="1" comment="64 bit architecture"/>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1" comment="64 bit architecture"/>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" comment="64 bit architecture"/>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_s390_64:obj:1" version="1" comment="64 bit architecture"/>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1" comment="32 bit architecture"/>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1" comment="64 bit architecture"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_usbguard_rules_nonempty:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/usbguard/(rules|rules\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^.*\S+.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_removable_partition:var:1</ind:var_ref>
        </ind:variable_object>
      </oval-def:objects>
      <oval-def:states>
        <ind:textfilecontent54_state id="oval:ssg-state_ars_shutdown:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_audit_failure_mode:var:1"/>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_group_owner_not_root_var_log_audit_directories:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_group_owner_not_root_var_log_audit_directories-non_root:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit_directories:ste:1" version="1" operator="OR">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0750:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0700:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_group_owner_not_root_var_log_audit:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
          <unix:user_id datatype="int" operation="equals">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_audit_rules_privileged_commands_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^(/dev/.*|composefs)$</linux:device>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_audit_rules_privileged_commands_nosuid_partitons:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_audit_rules_privileged_commands_noexec_partitons:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <unix:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_dracut_tmp_files:ste:1" version="1" operator="AND">
          <unix:filepath operation="pattern match">^/var/tmp/dracut.*</unix:filepath>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_audit_rules_privileged_commands_sysroot:ste:1" version="1" operator="AND" comment="Used to filter out all files in the /sysroot directory">
          <unix:filepath operation="pattern match">^/sysroot/.*$</unix:filepath>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_unprivileged_commands:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:ssg-var_audit_rules_privileged_commands_priv_cmds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_unprivileged_commands_bootc:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:ssg-var_audit_rules_privileged_commands_priv_cmds_bootc:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_priv_cmds_from_system:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_audit_rules_privileged_commands_priv_cmds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_priv_cmds_from_system_bootc:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_check="at least one" var_ref="oval:ssg-var_audit_rules_privileged_commands_priv_cmds_bootc:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_priv_cmds_from_augenrules_count:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="equals" var_check="at least one" var_ref="oval:ssg-var_priv_cmds_from_augenrules_count:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_priv_cmds_from_augenrules_count_bootc:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="equals" var_check="at least one" var_ref="oval:ssg-var_priv_cmds_from_augenrules_count_bootc:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_priv_cmds_from_auditctl_count:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="equals" var_check="at least one" var_ref="oval:ssg-var_priv_cmds_from_auditctl_count:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_auditd_disk_error_action_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action_stig_syslog:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">SYSLOG</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action_stig_single:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">SINGLE</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action_stig_halt:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">HALT</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_auditd_disk_full_action_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action_stig_syslog:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">SYSLOG</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action_stig_single:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">SINGLE</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action_stig_halt:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">HALT</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_auditd_admin_space_left_action_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action_stig_rotate:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">rotate</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action_stig_single:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">single</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_space_left:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2" operator="AND">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_auditd_space_left_action_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_space_left_percentage:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_name_format:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_auditd_name_format_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_overflow_action:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)(syslog|single|halt)(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fapolicy_default_deny_permissive_mode_off:ste:1" version="2" operator="AND" comment="permissive mode value is set to 0 (off) in fapolicyd settings file">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_root_mail_alias:ste:1" version="1" operator="AND" comment="root email alias">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_postfix_root_mail_alias:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_postmaster_mail_alias:ste:1" version="1" operator="AND" comment="postmaster email alias">
          <ind:subexpression operation="pattern match">(?i)root</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_postfix_network_listening_disabled:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-var_postfix_inet_interfaces:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_postfix_prevent_unrestricted_relay:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^permit_mynetworks[ \t]*[, \t][ \t]*reject$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_use_kerberos_security_all_exports:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*,sec=krb5\:krb5i\:krb5p.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_port_value_0:ste:1" version="1" operator="AND">
          <ind:subexpression>0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_cmdport_value_0:ste:1" version="1" operator="AND">
          <ind:subexpression>0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_time_service_set_maxpoll:ste:1" version="1" operator="AND">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_time_service_set_maxpoll:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_server_has_maxpoll:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">maxpoll \d+</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">altfiles</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_chrony_keys_gid_chrony:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_chrony_keys_uid_chrony:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_chrony_keys_uid_chrony:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_chrony_keys_gid_chrony_with_usrlib:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_chrony_keys_uid_chrony_with_usrlib:var:1"/>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_tftpd_uses_secure_mode:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_tftpd_secure_directory:var:1"/>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__sshd_private_key:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-filter_ssh_key_owner_root:ste:1" version="1" operator="AND" comment="All keys in /etc/ssh groupowned by root have the right permissions">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">.*_key$</unix:filename>
          <unix:group_id datatype="int">0</unix:group_id>
          <unix:user_id datatype="int">0</unix:user_id>
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-filter_ssh_key_owner_ssh_keys:ste:1" version="1" operator="AND" comment="All keys in /etc/ssh groupowned by ssh_keys have the right permissions">
          <unix:path>/etc/ssh</unix:path>
          <unix:filename operation="pattern match">.*_key$</unix:filename>
          <unix:group_id datatype="int" var_ref="oval:ssg-group_gid:var:1"/>
          <unix:user_id datatype="int">0</unix:user_id>
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:variable_state id="oval:ssg-state_firewalld_sshd_port_enabled_custom_zone_files_count:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="equals" var_check="at least one" var_ref="oval:ssg-var_firewalld_sshd_port_enabled_custom_zone_files_count:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_firewalld_sshd_port_enabled_ssh_service_file_etc:ste:1" version="1" operator="AND" comment="expected SSH port as defined by external variable">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-sshd_listening_port:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_rekey_limit:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-sshd_line_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1" operator="AND" comment="upper bound of ClientAliveInterval in seconds">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1" operator="AND" comment="lower bound of ClientAliveInterval in seconds">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_logingracetime_value_upper_bound:ste:1" version="1" operator="AND" comment="upper bound of LoginGraceTime in number of sessions">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_set_login_grace_time:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_logingracetime_value_lower_bound:ste:1" version="1" operator="AND" comment="lower bound of LoginGraceTime in number of sessions">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxauthtries_value_upper_bound:ste:1" version="1" operator="AND" comment="upper bound of MaxAuthTries in number of sessions">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_max_auth_tries_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxauthtries_value_lower_bound:ste:1" version="1" operator="AND" comment="lower bound of MaxAuthTries in number of sessions">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxsessions_value_upper_bound:ste:1" version="1" operator="AND" comment="upper bound of MaxSessions in number of sessions">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_max_sessions:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxsessions_value_lower_bound:ste:1" version="1" operator="AND" comment="lower bound of MaxSessions in number of sessions">
          <ind:subexpression datatype="int" operation="greater than or equal">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1" version="2" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_sshd_set_maxstartups_first:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1" version="2" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_sshd_set_maxstartups_second:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1" version="2" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_sshd_set_maxstartups_third:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-ste_sshd_use_strong_macs:ste:1" version="1" operator="AND" comment="strong macs">
          <ind:value operation="equals" datatype="string" var_ref="oval:ssg-var_sshd_strong_macs:var:1" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_certificate_verification:ste:1" version="1" operator="AND" comment="value of certificate_verification">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_sssd_certificate_verification_digest_function:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_enable_pam_services:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*pam.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_enable_smartcards:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">(?i)true</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_enable_smartcards_allow_missing_name:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*allow_missing_name.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_enable_smartcards_cert_auth:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*(try_cert_auth|require_cert_auth).*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_offline_cred_expiration:ste:1" version="1" operator="AND">
          <ind:subexpression>1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_cache_credentials:ste:1" version="1" operator="AND">
          <ind:subexpression operation="case insensitive equals">false</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_ldap_tls_reqcert:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">(?i)demand</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_use_starttls_sssd_conf:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">(?i)true</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_usbguard_auditbackend:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^LinuxAudit$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:symlink_state id="oval:ssg-state_disable_xwindows_runlevel_target:ste:1" version="1" operator="AND" comment="default.target is linked to multi-user.target">
          <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
          <unix:canonical_path operation="pattern match">^(/usr)?/lib/systemd/system/multi-user.target$</unix:canonical_path>
        </unix:symlink_state>
        <unix:symlink_state id="oval:ssg-state_pam_fingerprint_symlinked_to_authselect:ste:1" version="1" operator="AND" comment="see the test comment">
          <unix:filepath>/etc/pam.d/fingerprint-auth</unix:filepath>
          <unix:canonical_path>/etc/authselect/fingerprint-auth</unix:canonical_path>
        </unix:symlink_state>
        <unix:symlink_state id="oval:ssg-state_pam_password_symlinked_to_authselect:ste:1" version="1" operator="AND" comment="see the test comment">
          <unix:filepath>/etc/pam.d/password-auth</unix:filepath>
          <unix:canonical_path>/etc/authselect/password-auth</unix:canonical_path>
        </unix:symlink_state>
        <unix:symlink_state id="oval:ssg-state_pam_postlogin_symlinked_to_authselect:ste:1" version="1" operator="AND" comment="see the test comment">
          <unix:filepath>/etc/pam.d/postlogin</unix:filepath>
          <unix:canonical_path>/etc/authselect/postlogin</unix:canonical_path>
        </unix:symlink_state>
        <unix:symlink_state id="oval:ssg-state_pam_smartcard_symlinked_to_authselect:ste:1" version="1" operator="AND" comment="see the test comment">
          <unix:filepath>/etc/pam.d/smartcard-auth</unix:filepath>
          <unix:canonical_path>/etc/authselect/smartcard-auth</unix:canonical_path>
        </unix:symlink_state>
        <unix:symlink_state id="oval:ssg-state_pam_system_symlinked_to_authselect:ste:1" version="1" operator="AND" comment="see the test comment">
          <unix:filepath>/etc/pam.d/system-auth</unix:filepath>
          <unix:canonical_path>/etc/authselect/system-auth</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_issue:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_issue_net:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-remote_login_banner_text:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_motd:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" var_ref="oval:ssg-motd_banner_text:var:1" operation="pattern match"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gdm_login_banner_text_setting:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1"/>
        </ind:textfilecontent54_state>
        <linux:selinuxsecuritycontext_state id="oval:ssg-state_account_password_selinux_faillock_dir:ste:1" version="1" operator="AND" comment="faillog_t context is set">
          <linux:type datatype="string" operation="equals">faillog_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_pam_faillock_dir_parameter_not_default_value:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="not equal">/var/run/faillock</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_pam_faillock_dir_parameter_system_auth:ste:1" version="1" operator="AND">
          <ind:value>2</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_pam_faillock_dir_parameter_password_auth:ste:1" version="1" operator="AND">
          <ind:value>2</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_retry_upper_bound:ste:1" version="1" operator="AND" comment="upper bound of password_pam_retry">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_retry:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_retry_lower_bound:ste:1" version="1" operator="AND" comment="lower bound of password_pam_retry">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_set_password_hashing_algorithm_libuserconf:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_password_hashing_algorithm_pam:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_set_password_hashing_algorithm_logindefs:ste:1" version="1" operator="AND">
          <ind:value operation="pattern match" datatype="string" var_ref="oval:ssg-var_password_hashing_algorithm_regex:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_set_password_hashing_algorithm_passwordauth:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_password_hashing_algorithm_pam:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_pam_unix_hashing_algorithm_systemauth:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_password_hashing_algorithm_pam:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_login_defs_sha_crypt_rounds:ste:1" version="1" operator="AND" comment="Rounds should be set to more than 5000">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-local_var_password_hashing_min_rounds_login_defs:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_password_hashing_min_rounds_login_defs_le_5000:ste:1" version="1" operator="AND">
          <ind:value operation="less than or equal" datatype="int">5000</ind:value>
        </ind:variable_state>
        <unix:symlink_state id="oval:ssg-state_disable_ctrlaltdel_exists:ste:1" version="1" operator="AND" comment="Disable Ctrl-Alt-Del key sequence override exists">
          <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
          <unix:canonical_path>/dev/null</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_logind_session_timeout:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_logind_session_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_require_rescue_service:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_opensc_card_drivers:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_smartcard_drivers:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_no_duplicate_uids:ste:1" version="1" operator="AND">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_uids:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_default_os_user:ste:1" version="1" operator="AND" comment="The user root is always allowed as default opering system user">
          <ind:subexpression operation="pattern match">^root$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_authorized_local_users:ste:1" version="1" operator="AND" comment="authorized usernames required by the installed software groups and applications">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_accounts_authorized_local_users_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_no_duplicate_group_ids:ste:1" version="1" operator="AND">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_group_ids:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_auth_inactive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_auth_inactive_positive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_system_auth_inactive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_system_auth_inactive_positive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than" datatype="int">-1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1" operator="AND">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1" operator="AND">
          <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1" operator="AND">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1" operator="AND">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_test_accounts_password_set_max_life_existing_password_max_life_existing:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_test_accounts_password_set_max_life_existing_password_max_life_existing_minimum:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_check="all" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1"/>
        </ind:textfilecontent54_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_set_max_life_root:ste:1" version="1" operator="AND">
          <unix:chg_req operation="equals" var_ref="oval:ssg-var_accounts_maximum_age_root:var:1" datatype="int"/>
        </unix:shadow_state>
        <ind:textfilecontent54_state id="oval:ssg-state_test_accounts_password_set_min_life_existing_password_max_life_existing:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_test_accounts_password_set_min_life_existing_password_max_life_existing_minimum:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_check="all" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_test_accounts_password_set_warn_age_existing:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_check="all" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1" operator="AND">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_test_accounts_set_post_pw_existing:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1"/>
        </ind:textfilecontent54_state>
        <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1" operator="AND">
          <unix:password operation="pattern match" mask="true">^[x*]$</unix:password>
        </unix:password_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1" version="1" operator="AND">
          <unix:password operation="pattern match">^(!|!!|!\*|\*|!locked)$</unix:password>
        </unix:shadow_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_has_locked_password:ste:1" version="1" operator="AND">
          <unix:password operation="pattern match">^(!\$6\$|!!\$6\$).*$</unix:password>
        </unix:shadow_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1" version="1" operator="AND">
          <unix:encrypt_method operation="equals">SHA-512</unix:encrypt_method>
        </unix:shadow_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_sha512_hidepass:ste:1" version="1" operator="AND">
          <unix:password operation="pattern match" mask="true">.*</unix:password>
        </unix:shadow_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_chage_past_has_no_password:ste:1" version="1" operator="AND">
          <unix:password operation="pattern match">^(!|!!|!\*|\*|!locked)$</unix:password>
        </unix:shadow_state>
        <ind:variable_state id="oval:ssg-state_accounts_password_last_change_is_in_past_time_diff:ste:1" version="2" operator="AND">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_accounts_password_last_change_is_in_past_current_epoch:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_auth_pam_unix_rounds:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_system_auth_pam_unix_rounds:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one" datatype="string"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_root_gid_zero:ste:1" version="1" operator="AND" comment="root account's gid is equal to 0">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_ensure_pam_wheel_group_has_no_members:ste:1" version="1" operator="AND" comment="check if the group line does not contain members">
          <ind:text operation="pattern match">^[^:]+:[^:]+:[0-9]+:\s*$</ind:text>
        </ind:textfilecontent54_state>
        <unix:password_state id="oval:ssg-state_no_password_auth_for_systemaccounts_users_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="less than">1000</unix:user_id>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_no_password_auth_for_systemaccounts_users_ignored:ste:1" version="1" operator="AND">
          <unix:username datatype="string" operation="pattern match">^(root|halt|sync|shutdown|nfsnobody)$</unix:username>
        </unix:password_state>
        <unix:shadow_state id="oval:ssg-filter_no_password_auth_for_systemaccounts_no_passwords_or_locked_accounts:ste:1" version="1" operator="AND">
          <unix:password operation="pattern match">^(!|!!|!\*|\*|!locked).*$</unix:password>
        </unix:shadow_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_less_than_zero:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_less_than_sys_uid_min:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than" var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_use_pam_wheel_group_for_su:ste:1" version="1" operator="AND" comment="group name must be valid">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_pam_wheel_group_for_su:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_logon_fail_delay:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_accounts_fail_delay:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1" operator="AND">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_tmp_inst:ste:1" version="1" operator="AND">
          <unix:type>directory</unix:type>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_var_tmp_tmp_inst:ste:1" version="1" operator="AND">
          <unix:type>directory</unix:type>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:variable_state id="oval:ssg-state_accounts_tmout_defined:ste:1" version="1" operator="AND">
          <ind:value operation="greater than or equal" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="2" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_accounts_tmout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_user_dot_group_ownership_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_user_dot_group_ownership_gids_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_accounts_user_dot_group_ownership_gids:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_check="only one" var_ref="oval:ssg-var_accounts_user_dot_group_ownership_gids:var:1"/>
        </unix:file_state>
        <unix:password_state id="oval:ssg-state_accounts_user_dot_no_world_writable_programs_users_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_accounts_user_dot_no_world_writable_programs_users_ignored:ste:1" version="1" operator="AND">
          <unix:username datatype="string" operation="pattern match">^(nobody|nfsnobody)$</unix:username>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_accounts_user_dot_no_world_writable_programs_users_nologin_shell:ste:1" version="1" operator="AND">
          <unix:login_shell datatype="string" operation="pattern match">^/sbin/nologin$</unix:login_shell>
        </unix:password_state>
        <unix:file_state id="oval:ssg-state_world_writable_programs:ste:1" version="1" operator="AND">
          <unix:type>regular</unix:type>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_user_dot_user_ownership_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_user_dot_user_ownership_uids_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_accounts_user_dot_user_ownership_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" var_check="only one" var_ref="oval:ssg-var_accounts_user_dot_user_ownership_uids:var:1"/>
        </unix:file_state>
        <unix:password_state id="oval:ssg-state_accounts_user_interactive_home_directory_defined_users_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_accounts_user_interactive_home_directory_defined_users_ignored:ste:1" version="1" operator="AND">
          <unix:username datatype="string" operation="pattern match">^(nobody|nfsnobody)$</unix:username>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_accounts_user_interactive_home_directory_defined_users_nologin_shell:ste:1" version="1" operator="AND">
          <unix:login_shell datatype="string" operation="pattern match">^/sbin/nologin$</unix:login_shell>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_accounts_user_interactive_home_directory_defined:ste:1" version="1" operator="AND">
          <unix:home_dir operation="pattern match">^\/[^\/\n]*\/[^\/\n]{1,}.*$</unix:home_dir>
        </unix:password_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_user_interactive_home_directory_exists_objects_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_accounts_user_interactive_home_directory_exists_dirs_count_pw:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="equals" var_check="at least one" var_ref="oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_users_home_files_groupownership_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_users_home_files_groupownership_gids_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_accounts_users_home_files_groupownership_gids:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_check="only one" var_ref="oval:ssg-var_accounts_users_home_files_groupownership_gids:var:1"/>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_users_home_files_ownership_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_users_home_files_ownership_uids_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_accounts_users_home_files_ownership_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" var_check="only one" var_ref="oval:ssg-var_accounts_users_home_files_ownership_uids:var:1"/>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_users_home_files_permissions_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_accounts_users_home_files_permissions_is_symlink:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_accounts_users_home_files_permissions_dirs:ste:1" version="1" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_file_groupownership_home_directories_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_file_groupownership_home_directories_gids_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_home_directories_gids:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_check="only one" var_ref="oval:ssg-var_file_groupownership_home_directories_gids:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permission_user_init_files:ste:1" version="1" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:password_state id="oval:ssg-state_file_permission_user_init_files_users_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_file_permission_user_init_files_users_ignored:ste:1" version="1" operator="AND">
          <unix:username datatype="string" operation="pattern match">^(nobody|nfsnobody)$</unix:username>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_file_permission_user_init_files_users_nologin_shell:ste:1" version="1" operator="AND">
          <unix:login_shell datatype="string" operation="pattern match">^/sbin/nologin$</unix:login_shell>
        </unix:password_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_file_permissions_home_directories_objects_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_permissions_home_directories_dirs:ste:1" version="1" operator="AND">
          <unix:type operation="equals">directory</unix:type>
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:password_state id="oval:ssg-state_file_permissions_home_dirs_users_uids:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_file_permissions_home_dirs_users_ignored:ste:1" version="1" operator="AND">
          <unix:username datatype="string" operation="pattern match">^(nobody|nfsnobody)$</unix:username>
        </unix:password_state>
        <unix:password_state id="oval:ssg-state_file_permissions_home_dirs_users_nologin_shell:ste:1" version="1" operator="AND">
          <unix:login_shell datatype="string" operation="pattern match">^/sbin/nologin$</unix:login_shell>
        </unix:password_state>
        <unix:file_state id="oval:ssg-state_file_permissions_home_dirs_dirs:ste:1" version="1" operator="AND">
          <unix:type operation="equals">directory</unix:type>
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR" comment="group or other has write privilege">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1" operator="AND" comment="symbolic link">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:environmentvariable58_state id="oval:ssg-state_begins_colon_period:ste:1" version="1" operator="AND" comment="starts with colon or period">
          <ind:value operation="pattern match">^[:\.]</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state id="oval:ssg-state_contains_double_colon:ste:1" version="1" operator="AND" comment="colon twice in a row">
          <ind:value operation="pattern match">::</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state id="oval:ssg-state_contains_double_period:ste:1" version="1" operator="AND" comment="period twice in a row">
          <ind:value operation="pattern match">\.\.</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state id="oval:ssg-state_ends_colon_period:ste:1" version="1" operator="AND" comment="ends with colon or period">
          <ind:value operation="pattern match">[:\.]$</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state id="oval:ssg-state_begins_slash:ste:1" version="1" operator="AND" comment="begins with a slash">
          <ind:value operation="pattern match">^[^/]</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state id="oval:ssg-state_contains_relative_path:ste:1" version="1" operator="AND" comment="elements begin with a slash">
          <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
        </ind:environmentvariable58_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_bashrc:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_csh_cshrc:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_object_accounts_umask_interactive_users_objects_users_ignored:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^(nobody|nfsnobody)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_umask_interactive_users_bash_history:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">^\.bash_history</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_bootloader_superuser_differ_from_other_users:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="not equal" var_check="all" var_ref="oval:ssg-var_user_accounts:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_default_mmap_min_addr_x86_64:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">65536</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_default_mmap_min_addr_aarch64:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">32768</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_default_mmap_min_addr:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_kernel_config_default_mmap_min_addr_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_aarch64:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^aarch64$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_x86_64:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^x86_64$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-unit_logrotate_state_symlink:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rsyslog_remote_tls:ste:1" version="1" operator="AND" comment="value of omfwd action">
          <ind:subexpression datatype="string" operation="pattern match">(?=[\S\s]*\s(?i)protocol(?-i)="tcp")(?=[\S\s]*\s(?i)Target(?-i)="[^"]+?")(?=[\S\s]*\s(?i)port(?-i)="6514")(?=[\S\s]*\s(?i)StreamDriver(?-i)="gtls")(?=[\S\s]*\s(?i)StreamDriverMode(?-i)="1")(?=[\S\s]*\s(?i)StreamDriverAuthMode(?-i)="x509/name")(?=[\S\s]*\s(?i)StreamDriver\.CheckExtendedKeyPurpose(?-i)="on")</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_empty_resolv:ste:1" version="1" operator="AND">
          <unix:size datatype="int">0</unix:size>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_network_nmcli_permissions:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string">ResultActive=auth_admin</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:interface_state id="oval:ssg-state_promisc:ste:1" version="1" operator="AND">
          <unix:flag datatype="string" entity_check="at least one" operation="equals">PROMISC</unix:flag>
        </unix:interface_state>
        <unix:interface_state id="oval:ssg-state_wifi_up:ste:1" version="1" operator="AND">
          <unix:flag datatype="string" entity_check="at least one" operation="equals">UP</unix:flag>
        </unix:interface_state>
        <ind:textfilecontent54_state id="oval:ssg-state_networkmanager_dns_mode:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^.*\bdefault|none\b.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1" version="1" operator="AND" comment="uid greater than 0 and world writable">
          <unix:user_id datatype="int" operation="greater than">0</unix:user_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_dir_perms_world_writable_sticky_bits:ste:1" version="1" operator="AND">
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_dir_perms_world_writable_sticky_bits_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
        </linux:partition_state>
        <unix:file_state id="oval:ssg-state_system_commands_dirs_group_owner_not_root:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_system_commands_directory_bin_owner_not_root:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_system_commands_directory_sbin_owner_not_root:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_system_commands_directory_usr_bin_owner_not_root:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_system_commands_directory_usr_sbin_owner_not_root:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_system_commands_directory_usr_local_bin_owner_not_root:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_system_commands_directory_usr_local_sbin_owner_not_root:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_set:ste:1" version="1" operator="AND">
          <unix:sgid datatype="boolean">true</unix:sgid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_sysroot:ste:1" version="1" operator="AND" comment="Used to filter out all files in the /sysroot directory">
          <unix:filepath operation="pattern match">^/sysroot/.*$</unix:filepath>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_file_permissions_unauthorized_sgid_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
        </linux:partition_state>
        <ind:variable_state id="oval:ssg-state_file_permissions_unauthorized_sgid_rpm_filepaths:ste:1" version="1" operator="AND">
          <ind:value datatype="string" operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1"/>
        </ind:variable_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_set:ste:1" version="1" operator="AND">
          <unix:suid datatype="boolean">true</unix:suid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_sysroot:ste:1" version="1" operator="AND" comment="Used to filter out all files in the /sysroot directory">
          <unix:filepath operation="pattern match">^/sysroot/.*$</unix:filepath>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_file_permissions_unauthorized_suid_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
        </linux:partition_state>
        <ind:variable_state id="oval:ssg-state_file_permissions_unauthorized_suid_rpm_filepaths:ste:1" version="1" operator="AND">
          <ind:value datatype="string" operation="equals" var_check="at least one" var_ref="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1"/>
        </ind:variable_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1" operator="AND">
          <unix:type operation="equals">regular</unix:type>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_special_selinux_files:ste:1" version="1" operator="AND">
          <unix:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_sysroot:ste:1" version="1" operator="AND" comment="Used to filter out all files in the /sysroot directory">
          <unix:filepath operation="pattern match">^/sysroot/.*$</unix:filepath>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_file_permissions_unauthorized_world_writable_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
        </linux:partition_state>
        <unix:file_state id="oval:ssg-state_file_permissions_ungroupowned_local_group_owner:ste:1" version="1" operator="AND" comment="Used to filter out all files group-owned by a group defined in /etc/group">
          <unix:group_id datatype="int" var_check="at least one" var_ref="oval:ssg-var_all_local_gids:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_ungroupowned_local_group_owner_with_usrlib:ste:1" version="1" operator="AND" comment="Used to filter out all files group-owned by a group defined in /etc/group">
          <unix:group_id datatype="int" var_check="at least one" var_ref="oval:ssg-var_all_local_gids_with_usrlib:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_ungroupowned_sysroot:ste:1" version="1" operator="AND" comment="Used to filter out all files in the /sysroot directory">
          <unix:filepath operation="pattern match">^/sysroot/.*$</unix:filepath>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_file_permissions_ungroupowned_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_file_permissions_ungroupowned_nsswitch_uses_altfiles:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">altfiles</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_no_files_unowned_by_user_uids_list:ste:1" version="1" operator="AND">
          <unix:user_id var_check="at least one" datatype="int" var_ref="oval:ssg-var_no_files_unowned_by_user_uids_list:var:1"/>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_no_files_unowned_by_user_dev_partitons:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
        </linux:partition_state>
        <unix:file_state id="oval:ssg-state_groupowner_system_commands_dirs_not_root_or_system_account:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" operation="greater than or equal">1000</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <linux:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1" operator="AND">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
          <linux:mount_options datatype="string" entity_check="all" operation="not equal">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_non_root_partitions_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <ind:subexpression operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_core_pattern_empty_string_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="string" operation="equals"/>
        </unix:sysctl_state>
        <ind:variable_state id="oval:ssg-state_sysctl_kernel_core_pattern_empty_string_defined_in_one_file:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sysctl_kernel_core_pattern_empty_string_filepath_is_symlink:ste:1" version="1" operator="AND">
          <ind:filepath operation="equals" var_check="at least one" var_ref="oval:ssg-local_var_sysctl_kernel_core_pattern_empty_string_safe_symlinks:var:1" datatype="string"/>
        </ind:textfilecontent54_state>
        <unix:symlink_state id="oval:ssg-state_symlink_points_outside_usual_dirs_sysctl_kernel_core_pattern_empty_string:ste:1" version="1" operator="AND" comment="State that matches symlinks referencing files not in the default dirs">
          <unix:canonical_path operation="pattern match">^(?!(\/etc\/sysctl\.conf$|(\/etc|\/run|\/usr\/lib)\/sysctl\.d\/)).*$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern_empty_string:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_backtraces:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)0(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_backtraces_config_dir:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)0(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_storage:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)none(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_storage_config_dir:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)none(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limits_d:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_block_or_char_device_file:ste:1" version="1" operator="AND" comment="device files">
          <unix:type operation="pattern match">^(block|character) special$</unix:type>
        </unix:file_state>
        <linux:selinuxsecuritycontext_state id="oval:ssg-state_selinux_dev_device_t:ste:1" version="1" operator="AND" comment="device_t label">
          <linux:type datatype="string" operation="equals">device_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <linux:selinuxsecuritycontext_state id="oval:ssg-state_selinux_dev_unlabeled_t:ste:1" version="1" operator="AND" comment="unlabeled_t label">
          <linux:type datatype="string" operation="equals">unlabeled_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <linux:selinuxsecuritycontext_state id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1" operator="AND" comment="state unconfined_service_t">
          <linux:type datatype="string" operation="equals">unconfined_service_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <ind:textfilecontent54_state id="oval:ssg-state_selinux_not_disabled:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(enforcing|permissive)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_policy_name:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_state:var:1"/>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_installed_arch_of_kernel_package:ste:1" version="1" operator="AND">
          <linux:arch>x86_64</linux:arch>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_cpuinfo_64_bit:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">\blm\b</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(x86_64|aarch64|ppc64le|s390x|.*-amd64)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_local_db_is_up_to_date:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^false$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_screensaver_idle_delay_setting:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-inactivity_timeout_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_screensaver_lock_delay_setting:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_screensaver_lock_delay:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1" version="1" operator="AND">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_system_crypto_policy:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy_current:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_system_crypto_policy:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1" version="1" operator="AND">
          <ind:value datatype="string" operation="equals" var_ref="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1" version="1" operator="AND">
          <ind:value datatype="string" operation="equals">/etc/crypto-policies/back-ends/krb5.config</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^final all$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^512M 1h$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^hmac-sha2-512,hmac-sha2-256$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1" version="1" operator="AND">
          <ind:text var_ref="oval:ssg-sshd_ciphers_crypto:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_ciphers_opensshserver_conf_crypto_policy:ste:1" version="1" operator="AND">
          <ind:subexpression var_ref="oval:ssg-sshd_approved_ciphers:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1" version="1" operator="AND">
          <ind:text var_ref="oval:ssg-sshd_macs_crypto:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_macs_opensshserver_conf_crypto_policy:ste:1" version="1" operator="AND">
          <ind:subexpression var_ref="oval:ssg-sshd_macs_crypto_opensshserver:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_enable_dracut_fips_module:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals">fips</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_fips_1_argument_in_captured_group:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?fips=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-ste_system_crypto_policy_value:ste:1" version="2" operator="AND" comment="variable value is set to 'FIPS' or 'FIPS:modifier', where the modifier corresponds to a crypto policy module that further restricts the modified crypto policy.">
          <ind:value operation="pattern match" datatype="string">^FIPS(:OSPP)?$</ind:value>
        </ind:variable_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_aide_check_attributes:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_aide_use_fips_hashes:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*sha512.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_aide_verify_acls:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*acl.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_aide_verify_ext_attributes:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*xattrs.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_rpm_verify_hashes_fail_md5_hash:ste:1" version="1" operator="AND">
          <linux:md5_differs>fail</linux:md5_differs>
          <linux:configuration_file datatype="boolean">false</linux:configuration_file>
          <linux:ghost_file datatype="boolean">false</linux:ghost_file>
        </linux:rpmverifyfile_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_rpm_verify_ownership_files_fail_ownership:ste:1" version="2" operator="OR">
          <linux:ownership_differs>fail</linux:ownership_differs>
          <linux:group_differs>fail</linux:group_differs>
        </linux:rpmverifyfile_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_rpm_verify_permissions_files_fail_mode:ste:1" version="1" operator="AND">
          <linux:mode_differs>fail</linux:mode_differs>
        </linux:rpmverifyfile_state>
        <unix:file_state id="oval:ssg-state_sudo_file_gid_is_dedicated_group_gid:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dnf-automatic_apply_updates:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dnf-automatic_security_updates_only:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^security$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_oracle_package_gpg-pubkey-8d8b756f-629e59ec:ste:1" version="1" operator="AND">
          <linux:release>629e59ec</linux:release>
          <linux:version>8d8b756f</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_oracle_package_gpg-pubkey-8b4efbe6-629ec292:ste:1" version="1" operator="AND">
          <linux:release>629ec292</linux:release>
          <linux:version>8b4efbe6</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_dcredit:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_dcredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_dictcheck:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_password_pam_dictcheck:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_difok:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_difok:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_lcredit:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_lcredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxclassrepeat:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat_zero_comparison:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxrepeat:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minclass:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minclass:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minlen:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minlen:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_ocredit:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ocredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_ucredit:ste:1" version="3" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ucredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_upper_bound:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_deny_parameter_lower_bound:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_parameter_lower_bound:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_parameter_lower_bound:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_access_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_failed_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Unsuccessful file access (any other opens) This has to go last.
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_access_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_3_access_success_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Successful file access (any other opens) This has to go last.
## These next two are likely to result in a whole lot of events
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_basic_configuration_state_whole_file_contents_tc_audit_rules_d_10_base_config_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## First rule - delete all
-D

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 60000

## Set failure mode to syslog
-f 1

</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_create_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_failed_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Unsuccessful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_create_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_1_create_success_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Successful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_delete_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_failed_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Unsuccessful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_delete_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_4_delete_success_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Successful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_immutable_login_uids_state_whole_file_contents_tc_audit_rules_d_11_loginuid_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Make the loginuid immutable. This prevents tampering with the auid.
--loginuid-immutable

</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_modify_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_failed_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Unsuccessful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_modify_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_2_modify_success_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Successful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_module_load_state_whole_file_contents_tc_audit_rules_d_43_module_load_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## These rules watch for kernel module insertion. By monitoring
## the syscall, we do not need any watches on programs.
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_ospp_general_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## The purpose of these rules is to meet the requirements for Operating
## System Protection Profile (OSPP)v4.2. These rules depends on having
## the following rule files copied to /etc/audit/rules.d:
##
## 10-base-config.rules, 11-loginuid.rules,
## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
## 30-ospp-v42-5-perm-change-failed.rules,
## 30-ospp-v42-5-perm-change-success.rules,
## 30-ospp-v42-6-owner-change-failed.rules,
## 30-ospp-v42-6-owner-change-success.rules

## User add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch passwd and
## shadow for writes
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify

## User enable and disable. This is entirely handled by pam.

## Group add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch group and
## gshadow for writes
-a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify


## Use of special rights for config changes. This would be use of setuid
## programs that relate to user accts. This is not all setuid apps because
## requirements are only for ones that affect system configuration.
-a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes

## Privilege escalation via su or sudo. This is entirely handled by pam.
## Special case for systemd-run. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
## Special case for pkexec. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation


## Watch for configuration changes to privilege escalation.
-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

## Audit log access
-a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
-a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
## Attempts to Alter Process and Session Initiation Information
-a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session

## Attempts to modify MAC controls
-a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy
-a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy

## Software updates. This is entirely handled by rpm.

## System start and shutdown. This is entirely handled by systemd

## Kernel Module loading. This is handled in 43-module-load.rules

## Application invocation. The requirements list an optional requirement
## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
## state results from that policy. This would be handled entirely by
## that daemon.

</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_owner_change_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_failed_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Unsuccessful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_owner_change_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_6_owner_change_success_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Successful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_perm_change_failed_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_failed_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Unsuccessful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-audit_perm_change_success_state_whole_file_contents_tc_audit_rules_d_30_ospp_v42_5_perm_change_success_rules:ste:1" version="1" operator="AND">
          <ind:text operation="equals">## Successful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
</ind:text>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_freq:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)50(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_local_events:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)yes(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_log_format:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)ENRICHED(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_write_logs:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)yes(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^'lock-screen'$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_1:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_2:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdir_group_ownership_library_dirs_gid_0_3:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdir_group_ownership_library_dirs_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_1:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_2:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_3:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_4:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_binary_dirs_uid_0_5:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdir_ownership_binary_dirs_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_1:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_2:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdir_ownership_library_dirs_uid_0_3:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdir_ownership_library_dirs_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_0_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_1_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_2_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_3_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_4_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_binary_dirs_5_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_dir_permissions_binary_dirs:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_0_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_1_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_2_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdir_permissions_library_dirs_3_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_dir_permissions_library_dirs:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdirectory_groupowner_etc_ipsecd_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_ipsecd_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_ipsecd_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdirectory_groupowner_etc_iptables_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_iptables_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_iptables_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdirectory_groupowner_etc_nftables_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_nftables_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_nftables_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdirectory_groupowner_etc_selinux_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_selinux_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_selinux_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdirectory_groupowner_etc_sudoersd_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_sudoersd_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_sudoersd_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerdirectory_groupowner_etc_sysctld_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_sysctld_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerdirectory_groupowner_etc_sysctld_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdirectory_owner_etc_ipsecd_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdirectory_owner_etc_ipsecd_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdirectory_owner_etc_iptables_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdirectory_owner_etc_iptables_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdirectory_owner_etc_nftables_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdirectory_owner_etc_nftables_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdirectory_owner_etc_selinux_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdirectory_owner_etc_selinux_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdirectory_owner_etc_sudoersd_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdirectory_owner_etc_sudoersd_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerdirectory_owner_etc_sysctld_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerdirectory_owner_etc_sysctld_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdirectory_permissions_etc_ipsecd_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_directory_permissions_etc_ipsecd:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdirectory_permissions_etc_iptables_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_directory_permissions_etc_iptables:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdirectory_permissions_etc_nftables_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_directory_permissions_etc_nftables:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdirectory_permissions_etc_selinux_0_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_directory_permissions_etc_selinux:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdirectory_permissions_etc_sudoersd_0_mode_0750or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_directory_permissions_etc_sudoersd:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsdirectory_permissions_etc_sysctld_0_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_directory_permissions_etc_sysctld:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_disable_host_auth_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_disable_host_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_1:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_2:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_3:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_4:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_5:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_6:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_1:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_2:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_3:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_4:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_5:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_6:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_0_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_1_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_2_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_3_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_4_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_5_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissionsfile_audit_tools_permissions_6_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks_file_audit_tools_permissions:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_at_allow_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_at_allow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_allow_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_allow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_d_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_d_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_daily_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_daily_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_deny_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_deny_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_hourly_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_hourly_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_monthly_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_monthly_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_cron_weekly_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_cron_weekly_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_crontab_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_crontab_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_efi_grub2_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_efi_user_cfg_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_efi_user_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_crypttab_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_crypttab_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_crypttab_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_ipsec_conf_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_ipsec_conf_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_ipsec_conf_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_ipsec_secrets_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_ipsec_secrets_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_ipsec_secrets_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_issue_net_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_issue_net_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_sestatus_conf_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_sestatus_conf_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_sestatus_conf_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_shells_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_shells_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_sudoers_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_etc_sudoers_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_etc_sudoers_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_grub2_cfg_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_grub2_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_sshd_config_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_sshd_config_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_systemmap_gid_root_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupowner_systemmap_uid_root:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_systemmap_uid_root:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_user_cfg_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_user_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_var_log_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_messages_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_var_log_messages_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">4</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupowner_var_log_syslog_uid_4:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_audit_configuration_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_audit_configuration_gid_0_1:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownership_audit_configuration_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_sshd_private_key_gid_ssh_keys_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int" var_ref="oval:ssg-var_dedicated_groupownership_sshd_private_key_uid_ssh_keys:var:1"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownership_sshd_private_key_uid_ssh_keys:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownership_sshd_pub_key_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownership_sshd_pub_key_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_allow_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_allow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_d_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_d_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_daily_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_daily_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_deny_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_deny_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_hourly_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_hourly_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_monthly_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_monthly_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_cron_weekly_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_cron_weekly_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_crontab_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_crontab_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_efi_grub2_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_efi_user_cfg_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_efi_user_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_chrony_keys_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_chrony_keys_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_crypttab_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_crypttab_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_ipsec_conf_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_ipsec_conf_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_ipsec_secrets_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_ipsec_secrets_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_issue_net_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_issue_net_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_sestatus_conf_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_sestatus_conf_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_shells_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_shells_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_sudoers_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_etc_sudoers_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_grub2_cfg_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_grub2_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_sshd_config_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_sshd_config_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_systemmap_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_systemmap_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_user_cfg_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_user_cfg_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_var_log_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_messages_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_var_log_messages_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_syslog_uid_104_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">104</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_owner_var_log_syslog_uid_104:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_audit_configuration_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_audit_configuration_uid_0_1:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownership_audit_configuration_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_1:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_2:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_library_dirs_uid_0_3:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownership_library_dirs_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_sshd_private_key_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownership_sshd_private_key_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_ownership_sshd_pub_key_uid_0_0:ste:1" version="1" operator="AND">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_ownership_sshd_pub_key_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_at_allow_0_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__at_allow:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_audit_configuration_0_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_audit_configuration_1_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__audit_configuration:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_group_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_group:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_gshadow_0_mode_0000or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_gshadow:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_passwd_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_passwd:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_shadow_0_mode_0000or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__backup_etc_shadow:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_cron_allow_0_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__cron_allow:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_cron_d_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__cron_d:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_cron_daily_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__cron_daily:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_cron_hourly_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__cron_hourly:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_cron_monthly_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__cron_monthly:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_cron_weekly_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__cron_weekly:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_crontab_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__crontab:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_efi_grub2_cfg_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__efi_grub2_cfg:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_efi_user_cfg_0_mode_0700or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__efi_user_cfg:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_audit_auditd_0_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_audit_auditd:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_audit_rulesd_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_audit_rulesd:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_chrony_keys_0_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_chrony_keys:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_crypttab_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_crypttab:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_group_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_group:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_gshadow_0_mode_0000or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_gshadow:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_ipsec_conf_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_ipsec_conf:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_ipsec_secrets_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_ipsec_secrets:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_issue_net_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_issue_net:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_passwd_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_passwd:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_sestatus_conf_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_sestatus_conf:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_shadow_0_mode_0000or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_shadow:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_shells_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_shells:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_sudoers_0_mode_0440or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__etc_sudoers:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_grub2_cfg_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__grub2_cfg:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_0_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_1_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_2_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_library_dirs_3_mode_7755or_stricter_:ste:1" version="3" operator="AND">
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__library_dirs:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sshd_config_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__sshd_config:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sshd_pub_key_0_mode_0644or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__sshd_pub_key:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sudo_0_mode_4110:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__sudo:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_systemmap_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__systemmap:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_user_cfg_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__user_cfg:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_0_mode_0755or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:owrite datatype="boolean">false</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__var_log:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_messages_0_mode_0600or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__var_log_messages:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_syslog_0_mode_0640or_stricter_:ste:1" version="3" operator="AND">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-exclude_symlinks__var_log_syslog:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_firewalld-backend:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^nftables$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_audit_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_audit_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?audit=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_audit_backlog_limit_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_enable_iommu_force:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_iommu_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?iommu=force(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_init_on_alloc_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_init_on_alloc_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?init_on_alloc=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_l1tf_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_l1tf_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_l1tf_var_l1tf_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_mce_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_mce_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?mce=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_mds_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_mds_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_mds_var_mds_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_nosmap_argument_absent:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_nosmep_argument_absent:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_page_alloc_shuffle_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_page_alloc_shuffle_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?page_alloc\.shuffle=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_page_poison_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_page_poison_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?page_poison=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_pti_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_pti_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?pti=on(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_rng_core_default_quality_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rng_core_default_quality_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_rng_core_default_quality_var_rng_core_default_quality:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_slab_nomerge_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_slab_nomerge_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?slab_nomerge=yes(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_slub_debug_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_slub_debug_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_spec_store_bypass_disable_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_spec_store_bypass_disable_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-local_var_regex_spec_store_bypass_disable_var_spec_store_bypass_disable_options:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_spectre_v2_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_spectre_v2_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?spectre_v2=on(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_systemd_debug-shell_argument_absent:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_rescue_entry_for_grub2_vsyscall_argument:ste:1" version="1" operator="AND">
          <ind:filename operation="pattern match">.*rescue\.conf$</ind:filename>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_vsyscall_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?vsyscall=none(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_acpi_custom_method:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_acpi_custom_method:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_acpi_custom_method_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_arm64_sw_ttbr0_pan:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_arm64_sw_ttbr0_pan:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_binfmt_misc:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_binfmt_misc:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_binfmt_misc_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_bug:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_bug:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_bug_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_bug_on_data_corruption:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_bug_on_data_corruption:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_bug_on_data_corruption_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_compat_brk:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_compat_brk:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_compat_brk_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_compat_vdso:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_compat_vdso:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_compat_vdso_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_credentials:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_credentials:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_credentials_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_fs:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_fs:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_fs_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_list:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_list:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_list_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_notifiers:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_notifiers:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_notifiers_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_sg:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_sg:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_sg_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_debug_wx:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_debug_wx:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_debug_wx_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_devkmem:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_devkmem:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_devkmem_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_fortify_source:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_fortify_source:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_fortify_source_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_latent_entropy:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_latent_entropy:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_randstruct:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_randstruct:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_randstruct_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_stackleak:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_stackleak:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_stackleak_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_structleak:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_structleak:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_structleak_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_gcc_plugin_structleak_byref_all:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_gcc_plugin_structleak_byref_all:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_hardened_usercopy:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_hardened_usercopy:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_hardened_usercopy_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_hardened_usercopy_fallback:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_hardened_usercopy_fallback:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_hardened_usercopy_fallback_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_hibernation:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_hibernation:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_hibernation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_ia32_emulation:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_ia32_emulation:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_ia32_emulation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_ipv6:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_ipv6:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_ipv6_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_kexec:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_kexec:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_kexec_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_ptys:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_ptys:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_ptys_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_emulate:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_emulate:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_none:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_none:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_none_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_legacy_vsyscall_xonly:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_legacy_vsyscall_xonly:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_modify_ldt_syscall:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_modify_ldt_syscall:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_modify_ldt_syscall_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_all:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_all:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_all_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_force:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_force:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_force_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_hash:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_kernel_config_module_sig_hash:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_hash:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_hash_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_key:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_kernel_config_module_sig_key:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_key:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_key_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_module_sig_sha512:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_module_sig_sha512:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_module_sig_sha512_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning_no_sanity:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning_no_sanity:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_no_sanity_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_poisoning_zero:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_poisoning_zero:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_poisoning_zero_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_page_table_isolation:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_page_table_isolation:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_page_table_isolation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_panic_on_oops:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_panic_on_oops:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_panic_on_oops_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_panic_timeout:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string" var_ref="oval:ssg-var_kernel_config_panic_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_panic_timeout:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_panic_timeout_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_proc_kcore:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_proc_kcore:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_proc_kcore_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_randomize_base:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_randomize_base:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_randomize_base_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_randomize_memory:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_randomize_memory:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_randomize_memory_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_refcount_full:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_refcount_full:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_refcount_full_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_retpoline:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_retpoline:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_retpoline_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_sched_stack_end_check:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_sched_stack_end_check:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_sched_stack_end_check_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_seccomp:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_seccomp:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_seccomp_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_seccomp_filter:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_seccomp_filter:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_seccomp_filter_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security_dmesg_restrict:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security_dmesg_restrict:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_dmesg_restrict_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security_writable_hooks:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security_writable_hooks:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_writable_hooks_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_security_yama:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_security_yama:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_security_yama_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_freelist_hardened:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slab_freelist_hardened:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slab_freelist_hardened_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_freelist_random:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slab_freelist_random:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slab_freelist_random_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slab_merge_default:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slab_merge_default:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slab_merge_default_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_slub_debug:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_slub_debug:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_slub_debug_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_stackprotector:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_stackprotector:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_stackprotector_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_stackprotector_strong:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_stackprotector_strong:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_stackprotector_strong_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_strict_kernel_rwx:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_strict_kernel_rwx:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_strict_kernel_rwx_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_strict_module_rwx:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_strict_module_rwx:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_strict_module_rwx_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_syn_cookies:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_syn_cookies:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_syn_cookies_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_unmap_kernel_at_el0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_unmap_kernel_at_el0:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_unmap_kernel_at_el0_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_vmap_stack:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">y</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_vmap_stack:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_vmap_stack_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_kernel_config_x86_vsyscall_emulation:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">n</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_kernel_config_x86_vsyscall_emulation:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-local_var_config_x86_vsyscall_emulation_count_compliant_configs:var:1"/>
        </ind:variable_state>
        <linux:partition_state id="oval:ssg-state_boot_efi_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_boot_efi_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_boot_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_noexec_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_boot_partition_noexec_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_boot_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_dev_shm_partition_nodev_expected:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dev_shm_partition_nodev_expected_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_dev_shm_partition_noexec_expected:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dev_shm_partition_noexec_expected_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_dev_shm_partition_nosuid_expected:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dev_shm_partition_nosuid_expected_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_home_partition_grpquota:ste:1" version="1" operator="AND">
          <linux:mount_options entity_check="at least one" datatype="string" operation="equals">grpquota</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_home_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_home_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_home_partition_noexec:ste:1" version="1" operator="AND">
          <linux:mount_options entity_check="at least one" datatype="string" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_home_partition_nosuid:ste:1" version="1" operator="AND">
          <linux:mount_options entity_check="at least one" datatype="string" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_home_partition_usrquota:ste:1" version="1" operator="AND">
          <linux:mount_options entity_check="at least one" datatype="string" operation="equals">usrquota</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_sec_krb5_krb5i_krb5p:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*sec=krb5:krb5i:krb5p.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_nodev:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*nodev.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_noexec:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*noexec.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_nosuid:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">^.*nosuid.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_opt_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_opt_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_srv_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_srv_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_tmp_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_tmp_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_tmp_partition_noexec_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_tmp_partition_noexec_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_tmp_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_tmp_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_log_audit_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_log_audit_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_log_audit_partition_noexec_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_log_audit_partition_noexec_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_log_audit_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_log_audit_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_log_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_log_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_log_partition_noexec_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_log_partition_noexec_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_log_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_log_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_partition_noexec_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_partition_noexec_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_tmp_partition_nodev_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_tmp_partition_nodev_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nodev</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_tmp_partition_noexec_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_tmp_partition_noexec_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">noexec</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_var_tmp_partition_nosuid_optional:ste:1" version="1" operator="AND">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_tmp_partition_nosuid_optional_in_fstab:ste:1" version="1" operator="AND">
          <ind:instance datatype="int">1</ind:instance>
          <ind:subexpression entity_check="at least one" operation="pattern match">nosuid</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_0:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_1:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_2:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupownerroot_permissions_syslibrary_files_gid_0_3:ste:1" version="1" operator="AND">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-symlink_file_groupownerroot_permissions_syslibrary_files_uid_0:ste:1" version="1" operator="AND">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rsyslog_files_groupownership_ignore_include_paths:ste:1" version="1" operator="AND" comment="ignore">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1" operator="AND">
          <unix:type operation="equals">regular</unix:type>
          <unix:group_id datatype="int" var_ref="oval:ssg-var_rsyslog_files_groupownership_groupowner_gid:var:1"/>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rsyslog_files_ownership_ignore_include_paths:ste:1" version="1" operator="AND" comment="ignore">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1" operator="AND">
          <unix:type operation="equals">regular</unix:type>
          <unix:user_id datatype="int" var_ref="oval:ssg-var_rsyslog_files_ownership_owner_uid:var:1"/>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rsyslog_files_permissions_ignore_include_paths:ste:1" version="1" operator="AND" comment="ignore">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1" operator="AND">
          <unix:type operation="equals">regular</unix:type>
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_auditadm_exec_content:ste:1" version="1" operator="AND">
          <linux:name>auditadm_exec_content</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_auditadm_exec_content:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_auditadm_exec_content:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_authlogin_nsswitch_use_ldap:ste:1" version="1" operator="AND">
          <linux:name>authlogin_nsswitch_use_ldap</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_authlogin_nsswitch_use_ldap:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_authlogin_nsswitch_use_ldap:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_authlogin_radius:ste:1" version="1" operator="AND">
          <linux:name>authlogin_radius</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_authlogin_radius:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_authlogin_radius:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_deny_execmem:ste:1" version="1" operator="AND">
          <linux:name>deny_execmem</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_deny_execmem:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_deny_execmem:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_kerberos_enabled:ste:1" version="1" operator="AND">
          <linux:name>kerberos_enabled</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_kerberos_enabled:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_kerberos_enabled:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_polyinstantiation_enabled:ste:1" version="1" operator="AND">
          <linux:name>polyinstantiation_enabled</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_polyinstantiation_enabled:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_polyinstantiation_enabled:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_secure_mode_insmod:ste:1" version="1" operator="AND">
          <linux:name>secure_mode_insmod</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_secure_mode_insmod:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_secure_mode_insmod:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_selinuxuser_execheap:ste:1" version="1" operator="AND">
          <linux:name>selinuxuser_execheap</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_selinuxuser_execheap:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_selinuxuser_execheap:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_selinuxuser_execmod:ste:1" version="1" operator="AND">
          <linux:name>selinuxuser_execmod</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_selinuxuser_execmod:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_selinuxuser_execmod:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_selinuxuser_execstack:ste:1" version="1" operator="AND">
          <linux:name>selinuxuser_execstack</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_selinuxuser_execstack:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_selinuxuser_execstack:var:1"/>
        </linux:selinuxboolean_state>
        <linux:selinuxboolean_state id="oval:ssg-state_sebool_ssh_sysadm_login:ste:1" version="1" operator="AND">
          <linux:name>ssh_sysadm_login</linux:name>
          <linux:current_status datatype="boolean" var_ref="oval:ssg-var_ssh_sysadm_login:var:1"/>
          <linux:pending_status datatype="boolean" var_ref="oval:ssg-var_ssh_sysadm_login:var:1"/>
        </linux:selinuxboolean_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_atd_disabled_atd:ste:1" version="1" operator="AND" comment="atd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_atd_disabled_atd:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" version="1" operator="AND" comment="auditd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">auditd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_socket_on:ste:1" version="1" operator="AND" comment="auditd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">auditd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_auditd:ste:1" version="1" operator="AND" comment="auditd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_autofs_disabled_autofs:ste:1" version="1" operator="AND" comment="autofs is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_autofs_disabled_autofs:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_avahi-daemon_disabled_avahi-daemon:ste:1" version="1" operator="AND" comment="avahi-daemon is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_avahi-daemon_disabled_avahi-daemon:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_on:ste:1" version="1" operator="AND" comment="chronyd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">chronyd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_socket_on:ste:1" version="1" operator="AND" comment="chronyd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">chronyd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_chronyd:ste:1" version="1" operator="AND" comment="chronyd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_on:ste:1" version="1" operator="AND" comment="crond listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">crond.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_socket_on:ste:1" version="1" operator="AND" comment="crond listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">crond.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_crond:ste:1" version="1" operator="AND" comment="crond is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_debug-shell_disabled_debug-shell:ste:1" version="1" operator="AND" comment="debug-shell is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_debug-shell_disabled_debug-shell:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_fapolicyd_on:ste:1" version="1" operator="AND" comment="fapolicyd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">fapolicyd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_fapolicyd_socket_on:ste:1" version="1" operator="AND" comment="fapolicyd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">fapolicyd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_fapolicyd:ste:1" version="1" operator="AND" comment="fapolicyd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_on:ste:1" version="1" operator="AND" comment="firewalld listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">firewalld.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_socket_on:ste:1" version="1" operator="AND" comment="firewalld listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">firewalld.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_firewalld:ste:1" version="1" operator="AND" comment="firewalld is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_on:ste:1" version="1" operator="AND" comment="iptables listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">iptables.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_socket_on:ste:1" version="1" operator="AND" comment="iptables listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">iptables.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_iptables:ste:1" version="1" operator="AND" comment="iptables is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_kdump_disabled_kdump:ste:1" version="1" operator="AND" comment="kdump is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_kdump_disabled_kdump:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_nftables_disabled_nftables:ste:1" version="1" operator="AND" comment="nftables is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_nftables_disabled_nftables:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_oddjobd_disabled_oddjobd:ste:1" version="1" operator="AND" comment="oddjobd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_oddjobd_disabled_oddjobd:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_on:ste:1" version="1" operator="AND" comment="pcscd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">pcscd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_socket_on:ste:1" version="1" operator="AND" comment="pcscd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">pcscd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_pcscd:ste:1" version="1" operator="AND" comment="pcscd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_postfix_on:ste:1" version="1" operator="AND" comment="postfix listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">postfix.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_postfix_socket_on:ste:1" version="1" operator="AND" comment="postfix listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">postfix.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_postfix:ste:1" version="1" operator="AND" comment="postfix is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_rdisc_disabled_rdisc:ste:1" version="1" operator="AND" comment="rdisc is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_rdisc_disabled_rdisc:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_rlogin_disabled_rlogin:ste:1" version="1" operator="AND" comment="rlogin is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_rlogin_disabled_rlogin:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_on:ste:1" version="1" operator="AND" comment="rngd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">rngd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_socket_on:ste:1" version="1" operator="AND" comment="rngd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">rngd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_rngd:ste:1" version="1" operator="AND" comment="rngd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_rsyncd_disabled_rsyncd:ste:1" version="1" operator="AND" comment="rsyncd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_rsyncd_disabled_rsyncd:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" version="1" operator="AND" comment="rsyslog listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">rsyslog.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_socket_on:ste:1" version="1" operator="AND" comment="rsyslog listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">rsyslog.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_rsyslog:ste:1" version="1" operator="AND" comment="rsyslog is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_snmpd_disabled_snmpd:ste:1" version="1" operator="AND" comment="snmpd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_snmpd_disabled_snmpd:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_squid_disabled_squid:ste:1" version="1" operator="AND" comment="squid is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_squid_disabled_squid:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_sshd_disabled_sshd:ste:1" version="1" operator="AND" comment="sshd is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_sshd_disabled_sshd:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sshd_on:ste:1" version="1" operator="AND" comment="sshd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">sshd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sshd_socket_on:ste:1" version="1" operator="AND" comment="sshd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">sshd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_sshd:ste:1" version="1" operator="AND" comment="sshd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sssd_on:ste:1" version="1" operator="AND" comment="sssd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">sssd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sssd_socket_on:ste:1" version="1" operator="AND" comment="sssd listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">sssd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_sssd:ste:1" version="1" operator="AND" comment="sssd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_syslog-ng_on:ste:1" version="1" operator="AND" comment="syslog-ng listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">syslog-ng.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_syslog-ng_socket_on:ste:1" version="1" operator="AND" comment="syslog-ng listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">syslog-ng.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_syslog-ng:ste:1" version="1" operator="AND" comment="syslog-ng is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_socket_loadstate_is_masked_systemd-coredump:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_systemd-journald_on:ste:1" version="1" operator="AND" comment="systemd-journald listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">systemd-journald.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_systemd-journald_socket_on:ste:1" version="1" operator="AND" comment="systemd-journald listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">systemd-journald.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_systemd-journald:ste:1" version="1" operator="AND" comment="systemd-journald is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_telnet_disabled_telnet:ste:1" version="1" operator="AND" comment="telnet is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_telnet_disabled_telnet:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ufw_on:ste:1" version="1" operator="AND" comment="ufw listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">ufw.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ufw_socket_on:ste:1" version="1" operator="AND" comment="ufw listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">ufw.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ufw:ste:1" version="1" operator="AND" comment="ufw is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_on:ste:1" version="1" operator="AND" comment="usbguard listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">usbguard.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_socket_on:ste:1" version="1" operator="AND" comment="usbguard listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">usbguard.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_usbguard:ste:1" version="1" operator="AND" comment="usbguard is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_allow_only_protocol2_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^2$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_allow_only_protocol2:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^2$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_compression_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-local_var_regex_sshd_disable_compression:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_compression:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-local_var_regex_sshd_disable_compression:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_rsa_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_rsa:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^prohibit-password$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^prohibit-password$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pam_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pam:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pubkey_auth_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_pubkey_auth:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_net_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue.net$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_net:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue.net$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-local_var_regex_sshd_set_keepalive:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-local_var_regex_sshd_set_keepalive:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^0$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^0$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^INFO$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^INFO$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^VERBOSE$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^VERBOSE$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_use_priv_separation_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-local_var_regex_sshd_use_priv_separation:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_use_priv_separation:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-local_var_regex_sshd_use_priv_separation:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost_sshd_included_files:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_logfile_sudoers:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-var_sudo_logfile:var:1"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_fifos_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_fs_protected_fifos:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_hardlinks_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_fs_protected_hardlinks:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_regular_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_fs_protected_regular:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_fs_protected_symlinks_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_fs_protected_symlinks:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_fs_suid_dumpable_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_fs_suid_dumpable:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_core_pattern_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="string" operation="equals">|/bin/false</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_core_pattern:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="string">|/bin/false</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_core_uses_pid_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_core_uses_pid:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_dmesg_restrict_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_dmesg_restrict:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_kexec_load_disabled_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_kexec_load_disabled:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_kptr_restrict_runtime_1:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_kptr_restrict_runtime_2:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_kptr_restrict_1:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_kptr_restrict_2:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_modules_disabled_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_modules_disabled:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_panic_on_oops_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_panic_on_oops:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_cpu_time_max_percent_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_perf_cpu_time_max_percent:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_event_max_sample_rate_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_perf_event_max_sample_rate:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_perf_event_paranoid_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_perf_event_paranoid:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_pid_max_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">65536</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_pid_max:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">65536</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_randomize_va_space_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_randomize_va_space:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_sysrq_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_sysrq:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime_1:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_unprivileged_bpf_disabled_accept_default_runtime_2:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default_1:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_unprivileged_bpf_disabled_accept_default_2:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_yama_ptrace_scope_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_kernel_yama_ptrace_scope:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_core_bpf_jit_harden_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_core_bpf_jit_harden:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_local_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_local:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_filter_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_arp_filter:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_arp_ignore_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_arp_ignore:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_drop_gratuitous_arp_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_drop_gratuitous_arp:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_forwarding_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_forwarding:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_log_martians:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_route_localnet_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_route_localnet:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_runtime_1:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter_runtime_2:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_rp_filter_1:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_rp_filter_2:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">2</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_send_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_shared_media_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_all_shared_media:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_log_martians:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_rp_filter:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_send_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_shared_media_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_conf_default_shared_media:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_ip_forward_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_ip_forward:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_ip_local_port_range_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="string" operation="pattern match">32768\s*65535</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_ip_local_port_range:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match" datatype="string">32768\s*65535</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_tcp_rfc1337_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_tcp_rfc1337:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv4_tcp_syncookies:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_defrtr_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_pinfo_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_source_route_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_autoconf_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_autoconf:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_forwarding_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_forwarding:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_max_addresses_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_max_addresses:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_router_solicitations_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_all_router_solicitations:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_defrtr_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_pinfo_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_source_route_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_autoconf_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_autoconf:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_disable_ipv6_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_disable_ipv6:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_max_addresses_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_max_addresses:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_router_solicitations_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_net_ipv6_conf_default_router_solicitations:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_user_max_user_namespaces_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_user_max_user_namespaces:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_vm_mmap_min_addr_runtime:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">65536</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_sysctl_vm_mmap_min_addr:ste:1" version="1" operator="AND">
          <ind:subexpression operation="equals" datatype="int">65536</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_tmp_on:ste:1" version="1" operator="AND" comment="tmp mount is listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">tmp.mount</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_mount_running_tmp:ste:1" version="1" operator="AND" comment="tmp mount is active">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_dnf-automatic_on:ste:1" version="1" operator="AND" comment="dnf-automatic listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">dnf-automatic.timer</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_timer_running_dnf-automatic:ste:1" version="1" operator="AND" comment="dnf-automatic is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_logrotate_on:ste:1" version="1" operator="AND" comment="logrotate listed at least once in the dependencies">
          <linux:dependency entity_check="at least one">logrotate.timer</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_timer_running_logrotate:ste:1" version="1" operator="AND" comment="logrotate is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <ind:textfilecontent54_state id="oval:ssg-state_bootloader_disable_recovery_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(true|"true")$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol9_system:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">rhcos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">4</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^8\.\d{1,2}$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1" operator="AND">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:4.4</linux:evr>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_suma_4:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^4.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle_hpc:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_slmicro5_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_slmicroos5:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^5.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_slmicro5:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^5.*$</linux:version>
        </linux:rpminfo_state>
        <ind:variable_state id="oval:ssg-state_sshd_not_required:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_sshd_required:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int">2</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_sshd_requirement_unset:ste:1" version="1" operator="AND">
          <ind:value operation="equals" datatype="int">0</ind:value>
        </ind:variable_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_aarch_64:ste:1" version="1" operator="AND" comment="64 bit architecture">
          <unix:processor_type operation="equals">aarch64</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1" operator="AND" comment="64 bit architecture">
          <unix:processor_type operation="equals">ppc64</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1" operator="AND" comment="64 bit architecture">
          <unix:processor_type operation="equals">ppc64le</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_s390_64:ste:1" version="1" operator="AND" comment="64 bit architecture">
          <unix:processor_type operation="equals">s390x</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1" operator="AND" comment="32 bit architecture">
          <unix:processor_type operation="equals">i686</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1" operator="AND" comment="64 bit architecture">
          <unix:processor_type operation="equals">x86_64</unix:processor_type>
        </unix:uname_state>
        <ind:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1" operator="AND">
          <ind:value operation="equals">/dev/cdrom</ind:value>
        </ind:variable_state>
      </oval-def:states>
      <oval-def:variables>
        <oval-def:external_variable id="oval:ssg-var_audit_failure_mode:var:1" version="1" datatype="string" comment="external variable for audit failure mode"/>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-audit_log_dir_group_ownership:var:1" version="1" datatype="string" comment="path to audit log directory">
          <oval-def:regex_capture pattern="^(.*)\/([^\/]+$)">
            <oval-def:variable_component var_ref="oval:ssg-audit_log_file_path:var:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_directory_ownership_var_log_audit_path:var:1" version="1" datatype="string" comment="Path to log_file">
          <oval-def:object_component item_field="path" object_ref="oval:ssg-object_directory_ownership_var_log_audit_file:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-audit_log_dir:var:1" version="1" datatype="string" comment="path to audit log directory">
          <oval-def:regex_capture pattern="^(.*)\/([^\/]+$)">
            <oval-def:variable_component var_ref="oval:ssg-audit_log_file_path:var:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rules_privileged_commands_exec_mountpoints:var:1" version="1" datatype="string" comment="Mount points where suid or sgid files can be executed">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_audit_rules_privileged_commands_exec_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rules_privileged_commands_priv_cmds:var:1" version="1" datatype="string" comment="Filepath of all privileged commands found in the system">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_audit_rules_privileged_commands:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rules_privileged_commands_priv_cmds_bootc:var:1" version="1" datatype="string" comment="Filepath of all privileged commands found in the system">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_audit_rules_privileged_commands_bootc:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rules_privileged_commands_priv_cmds_count:var:1" version="1" datatype="int" comment="Count all privileged commands present in the system">
          <oval-def:count>
            <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_audit_rules_privileged_commands:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rules_privileged_commands_priv_cmds_count_bootc:var:1" version="1" datatype="int" comment="Count all privileged commands present in the system">
          <oval-def:count>
            <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_audit_rules_privileged_commands_bootc:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rules_privileged_commands_rule_regex:var:1" version="1" datatype="string" comment="Regex for auditd rule">
          <oval-def:literal_component>^[\s]*-a always,exit (?:-F path=([\S]+))+(?: -F perm=x)? -F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_priv_cmds_from_augenrules_count:var:1" version="1" datatype="int" comment="Count privileged commands found in audit rules in augenrules format">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_priv_cmds_from_augenrules:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_priv_cmds_from_augenrules_count_bootc:var:1" version="1" datatype="int" comment="Count privileged commands found in audit rules in augenrules format">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_priv_cmds_from_augenrules_bootc:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_priv_cmds_from_auditctl_count:var:1" version="1" datatype="int" comment="Count privileged commands found in audit rules in auditctl format">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_priv_cmds_from_auditctl:obj:1" item_field="subexpression"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_auditd_disk_error_action_regex:var:1" version="1" datatype="string" comment="Build regex to be case insensitive">
          <oval-def:concat>
            <oval-def:literal_component>(?i)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_auditd_disk_error_action:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_auditd_disk_error_action:var:1" version="1" datatype="string" comment="audit disk_error_action setting"/>
        <oval-def:local_variable id="oval:ssg-var_auditd_disk_full_action_regex:var:1" version="1" datatype="string" comment="Build regex to be case insensitive">
          <oval-def:concat>
            <oval-def:literal_component>(?i)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_auditd_disk_full_action:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_auditd_disk_full_action:var:1" version="1" datatype="string" comment="audit disk_full_action setting"/>
        <oval-def:external_variable id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1" datatype="string" comment="audit action_mail_acct setting"/>
        <oval-def:local_variable id="oval:ssg-var_auditd_admin_space_left_action_regex:var:1" version="1" datatype="string" comment="Build regex to be case insensitive">
          <oval-def:concat>
            <oval-def:literal_component>(?i)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1" datatype="string" comment="audit admin_space_left_action setting"/>
        <oval-def:external_variable id="oval:ssg-var_auditd_flush:var:1" version="1" datatype="string" comment="audit flush setting"/>
        <oval-def:external_variable id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1" datatype="string" comment="audit max_log_file_action setting"/>
        <oval-def:external_variable id="oval:ssg-var_auditd_space_left:var:1" version="1" datatype="int" comment="audit space_left setting"/>
        <oval-def:local_variable id="oval:ssg-var_auditd_space_left_action_regex:var:1" version="1" datatype="string" comment="Build regex to be case insensitive">
          <oval-def:concat>
            <oval-def:literal_component>(?i)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_auditd_space_left_action:var:1" version="2" datatype="string" comment="audit space_left_action setting"/>
        <oval-def:external_variable id="oval:ssg-var_auditd_space_left_percentage:var:1" version="1" datatype="int" comment="audit space_left setting"/>
        <oval-def:local_variable id="oval:ssg-var_auditd_name_format_regex:var:1" version="1" datatype="string" comment="Build regex to be case insensitive">
          <oval-def:concat>
            <oval-def:literal_component>(?i)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_auditd_name_format:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_auditd_name_format:var:1" version="1" datatype="string" comment="audit name_format setting"/>
        <oval-def:external_variable id="oval:ssg-var_postfix_root_mail_alias:var:1" version="1" datatype="string" comment="expected email alias"/>
        <oval-def:external_variable id="oval:ssg-var_postfix_inet_interfaces:var:1" version="1" datatype="string" comment="external variable for postfix inet_interfaces"/>
        <oval-def:external_variable id="oval:ssg-var_multiple_time_servers:var:1" version="1" datatype="string" comment="remote vendor-approved time servers"/>
        <oval-def:local_variable id="oval:ssg-temp_variable_test_servers:var:1" version="1" datatype="string" comment="a local variable which includes all vendor-approved time servers">
          <oval-def:concat>
            <oval-def:literal_component>^(?:server)[[:space:]]</oval-def:literal_component>
            <oval-def:split delimiter=",">
              <oval-def:variable_component var_ref="oval:ssg-var_multiple_time_servers:var:1"/>
            </oval-def:split>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_multiple_time_pools:var:1" version="1" datatype="string" comment="remote vendor-approved pool servers"/>
        <oval-def:local_variable id="oval:ssg-temp_variable_test_pools:var:1" version="1" datatype="string" comment="a local variable which includes all vendor-approved pool servers">
          <oval-def:concat>
            <oval-def:literal_component>^(?:pool)[[:space:]]</oval-def:literal_component>
            <oval-def:split delimiter=",">
              <oval-def:variable_component var_ref="oval:ssg-var_multiple_time_pools:var:1"/>
            </oval-def:split>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_time_service_set_maxpoll:var:1" version="1" datatype="int" comment="maxpoll value"/>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_chrony_keys_uid_chrony:var:1" version="1" datatype="int" comment="gid of the dedicated chrony group">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_groupowner_etc_chrony_keys_etc_group:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_chrony_keys_uid_chrony_with_usrlib:var:1" version="1" datatype="int" comment="gid of the dedicated chrony group">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_groupowner_etc_chrony_keys_etc_group_with_usrlib:obj:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_tftpd_secure_directory:var:1" version="1" datatype="string" comment="TFTP server secure directory"/>
        <oval-def:local_variable id="oval:ssg-group_gid:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_group_gid:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-ssh_client_line_regex:var:1" version="1" datatype="string" comment="The regex of the directive">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*RekeyLimit[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_ssh_client_rekey_limit_size:var:1"/>
            <oval-def:literal_component>[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_ssh_client_rekey_limit_time:var:1"/>
            <oval-def:literal_component>[\s]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_ssh_client_rekey_limit_size:var:1" version="1" datatype="string" comment="Size component of the rekey limit"/>
        <oval-def:external_variable id="oval:ssg-var_ssh_client_rekey_limit_time:var:1" version="1" datatype="string" comment="Time component of the rekey limit"/>
        <oval-def:local_variable id="oval:ssg-var_firewalld_sshd_port_enabled_default_zones:var:1" version="1" datatype="string" comment="Regex containing the list of zones files delivered in the firewalld package">
          <oval-def:literal_component>^(dmz|external|home|internal|public|trusted|work)\.xml$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count:var:1" version="1" datatype="int" comment="Variable including number of custom zone files allowing ssh">
          <oval-def:count>
            <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_firewalld_sshd_port_enabled_zone_files_etc:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_firewalld_sshd_port_enabled_custom_zone_files_count:var:1" version="1" datatype="int" comment="Variable including number of custom zone files present in /etc/firewalld/zones">
          <oval-def:count>
            <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_firewalld_sshd_port_enabled_custom_zone_files:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sshd_listening_port:var:1" version="1" datatype="int" comment="external variable containing the expected SSH port"/>
        <oval-def:local_variable id="oval:ssg-sshd_line_regex:var:1" version="1" datatype="string" comment="The regex of the directive">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rekey_limit_size:var:1"/>
            <oval-def:literal_component>[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rekey_limit_time:var:1"/>
            <oval-def:literal_component>[\s]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_rekey_limit_size:var:1" version="1" datatype="string" comment="Size component of the rekey limit"/>
        <oval-def:external_variable id="oval:ssg-var_rekey_limit_time:var:1" version="1" datatype="string" comment="Time component of the rekey limit"/>
        <oval-def:external_variable id="oval:ssg-sshd_idle_timeout_value:var:1" version="1" datatype="int" comment="timeout value"/>
        <oval-def:external_variable id="oval:ssg-var_sshd_set_login_grace_time:var:1" version="1" datatype="int" comment="logingracetime value"/>
        <oval-def:external_variable id="oval:ssg-sshd_max_auth_tries_value:var:1" version="1" datatype="int" comment="MaxAuthTries value"/>
        <oval-def:external_variable id="oval:ssg-var_sshd_max_sessions:var:1" version="1" datatype="int" comment="maxsessions value"/>
        <oval-def:external_variable id="oval:ssg-var_sshd_set_maxstartups:var:1" version="1" datatype="string" comment="Expected value for MaxStartups parameter"/>
        <oval-def:local_variable id="oval:ssg-var_sshd_set_maxstartups_first:var:1" version="1" datatype="int" comment="First number from MaxStartup parameter value.">
          <oval-def:regex_capture pattern="(\d+):\d+:\d+">
            <oval-def:variable_component var_ref="oval:ssg-var_sshd_set_maxstartups:var:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_set_maxstartups_second:var:1" version="1" datatype="int" comment="Second number from MaxStartup parameter value.">
          <oval-def:regex_capture pattern="\d+:(\d+):\d+">
            <oval-def:variable_component var_ref="oval:ssg-var_sshd_set_maxstartups:var:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_set_maxstartups_third:var:1" version="1" datatype="int" comment="Third number from MaxStartup parameter value.">
          <oval-def:regex_capture pattern="\d+:\d+:(\d+)">
            <oval-def:variable_component var_ref="oval:ssg-var_sshd_set_maxstartups:var:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sshd_approved_ciphers:var:1" version="1" datatype="string" comment="SSH Approved Ciphers by FIPS"/>
        <oval-def:external_variable id="oval:ssg-sshd_approved_macs:var:1" version="1" datatype="string" comment="SSH Approved MACs by FIPS"/>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_strong_macs:var:1" version="1" datatype="string" comment="MACs values splitted on comma">
          <oval-def:split delimiter=",">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_config_strong_macs:obj:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_strong_macs:var:1" version="1" datatype="string" comment="strong MACs values splitted on comma">
          <oval-def:split delimiter=",">
            <oval-def:variable_component var_ref="oval:ssg-sshd_strong_macs:var:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-sshd_strong_macs:var:1" version="1" datatype="string" comment="SSH MAC algorithms considered strong"/>
        <oval-def:external_variable id="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" version="1" datatype="string" comment="certificate_verification value"/>
        <oval-def:external_variable id="oval:ssg-login_banner_text:var:1" version="1" datatype="string" comment="warning banner text variable"/>
        <oval-def:external_variable id="oval:ssg-remote_login_banner_text:var:1" version="1" datatype="string" comment="warning banner text variable"/>
        <oval-def:external_variable id="oval:ssg-motd_banner_text:var:1" version="1" datatype="string" comment="warning banner text variable"/>
        <oval-def:constant_variable id="oval:ssg-var_pam_faillock_password_auth_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_pam_faillock_password_auth_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_pam_faillock_system_auth_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_pam_faillock_system_auth_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_account_password_selinux_faillock_dir_collector:var:1" version="1" datatype="string" comment="List of directories defined in pam_faillock.so dir parameters">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_account_password_selinux_faillock_dir_collector:obj:1"/>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_account_pam_faillock_audit_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify audit parameter in pam files">
          <oval-def:value>^[\s]*auth[\s]+(?:required|requisite)[\s]+pam_faillock.so[^\n#]preauth[^\n#]*audit</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-var_password_pam_remember:var:1" version="1" datatype="int" comment="number of passwords that should be remembered"/>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_pwhistory_remember_password_auth_module_regex:var:1" version="1" datatype="string" comment="The regex is to confirm the pam_pwhistory.so module is enabled">
          <oval-def:concat>
            <oval-def:literal_component>^\s*password\s+(?:</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_possible_control_flags_password_auth:var:1"/>
            <oval-def:literal_component>)\s+pam_pwhistory\.so.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_possible_control_flags_password_auth:var:1" version="1" datatype="string" comment="All accepted control flags">
          <oval-def:split delimiter=",">
            <oval-def:variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_password_pam_remember_control_flag:var:1" version="1" datatype="string" comment="control flag for pwhistory module"/>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_pwhistory_remember_password_auth_pam_param_regex:var:1" version="1" datatype="string" comment="The regex is to collect the pam_pwhistory.so remember paramerter from PAM files">
          <oval-def:literal_component>^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_pwhistory_remember_password_auth_conf_param_regex:var:1" version="1" datatype="string" comment="The regex is to collect the pam_pwhistory.so remember paramerter in pwhistory.conf">
          <oval-def:literal_component>^\s*remember\s*=\s*([0-9]+)</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_pwhistory_remember_system_auth_module_regex:var:1" version="1" datatype="string" comment="The regex is to confirm the pam_pwhistory.so module is enabled">
          <oval-def:concat>
            <oval-def:literal_component>^\s*password\s+(?:</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_possible_control_flags_system_auth:var:1"/>
            <oval-def:literal_component>)\s+pam_pwhistory\.so.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_possible_control_flags_system_auth:var:1" version="1" datatype="string" comment="All accepted control flags">
          <oval-def:split delimiter=",">
            <oval-def:variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_pwhistory_remember_system_auth_pam_param_regex:var:1" version="1" datatype="string" comment="The regex is to collect the pam_pwhistory.so remember paramerter from PAM files">
          <oval-def:literal_component>^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_pwhistory_remember_system_auth_conf_param_regex:var:1" version="1" datatype="string" comment="The regex is to collect the pam_pwhistory.so remember paramerter in pwhistory.conf">
          <oval-def:literal_component>^\s*remember\s*=\s*([0-9]+)</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_password_pam_unix_remember:var:1" version="1" datatype="int" comment="number of passwords that should be remembered"/>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_unix_remember_module_regex:var:1" version="1" datatype="string" comment="The regex is to confirm the pam_pwhistory.so module is enabled">
          <oval-def:literal_component>^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_unix_remember_pam_param_regex:var:1" version="1" datatype="string" comment="The regex is to collect the pam_pwhistory.so remember paramerter from PAM files">
          <oval-def:literal_component>^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_pam_unix_remember_conf_param_regex:var:1" version="1" datatype="string" comment="The regex is to collect the pam_pwhistory.so remember paramerter in pwhistory.conf">
          <oval-def:literal_component>^\s*remember\s*=\s*([0-9]+)</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_pam_faillock_audit_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify audit parameter in pam files">
          <oval-def:value>^[\s]*auth[\s]+(?:required|requisite)[\s]+pam_faillock.so[^\n#]preauth[^\n#]*audit</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_unix_regex:var:1" version="1" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^[\s]*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_auth_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_account_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_pam_faillock_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so deny entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_root_faillock_conf_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify deny entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*even_deny_root</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_faillock_dir_parameter_regex:var:1" version="1" datatype="string" comment="common regex to identify dir entry">
          <oval-def:value>dir\s*=\s*(\S+|"[^"]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_pam_faillock_dir_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify dir parameter in pam files">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*auth[\s]+(?:required|requisite)</oval-def:literal_component>
            <oval-def:literal_component>[\s]+pam_faillock.so[^\n#]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_faillock_dir_parameter_regex:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_faillock_conf_dir_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify dir parameter in faillock.conf file">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_faillock_dir_parameter_regex:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_faillock_dir_set_both_preauth_authfail_system_auth:var:1" version="1" datatype="int" comment="Counts the unique occurrences of preauth and authfail so if it is two, it       demonstrates both are present, this takes the results from system-auth file">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:regex_capture pattern="(authfail|preauth)">
                <oval-def:object_component item_field="text" object_ref="oval:ssg-obj_all_pam_faillock_dir_parameter_system_auth:obj:1"/>
              </oval-def:regex_capture>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_faillock_dir_set_both_preauth_authfail_password_auth:var:1" version="1" datatype="int" comment="Counts the unique occurrences of preauth and authfail so if it is two, it       demonstrates both are present, this takes the results from password-auth file">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:regex_capture pattern="(authfail|preauth)">
                <oval-def:object_component item_field="text" object_ref="oval:ssg-obj_all_pam_faillock_dir_parameter_password_auth:obj:1"/>
              </oval-def:regex_capture>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_password_pam_retry:var:1" version="1" datatype="int" comment="External variable for pam_pwquality retry"/>
        <oval-def:external_variable id="oval:ssg-var_password_hashing_algorithm_pam:var:1" version="1" datatype="string" comment="hashing algorithm for pam_unix.so"/>
        <oval-def:local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" version="1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs">
          <oval-def:regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_password_hashing_algorithm_regex:var:1" version="1" datatype="string" comment="Limit regex">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_password_hashing_algorithm:var:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_password_hashing_algorithm:var:1" version="1" datatype="string" comment="hashing algorithm for /etc/login.defs"/>
        <oval-def:local_variable id="oval:ssg-local_var_password_hashing_min_rounds_login_defs:var:1" version="1" datatype="int" comment="variable storing number of password hashing rounds">
          <oval-def:variable_component var_ref="oval:ssg-var_password_hashing_min_rounds_login_defs:var:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_password_hashing_min_rounds_login_defs:var:1" version="1" datatype="int" comment="Variable defining the value the argument should have"/>
        <oval-def:external_variable id="oval:ssg-var_logind_session_timeout:var:1" version="1" datatype="int" comment="idle session timeout in seconds"/>
        <oval-def:external_variable id="oval:ssg-var_smartcard_drivers:var:1" version="1" datatype="string" comment="external variable for opensc smartcard drivers"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_uids:var:1" version="1" datatype="int" comment="Count of all uids (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="user_id" object_ref="oval:ssg-obj_all_uids:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_uids:var:1" version="1" datatype="int" comment="Count of unique uids">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="user_id" object_ref="oval:ssg-obj_all_uids:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_authorized_local_users_regex:var:1" version="1" datatype="string" comment="accounts authorized local users on operating system"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_group_ids:var:1" version="1" datatype="int" comment="Count of all group ids (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_all_group_ids:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_group_ids:var:1" version="1" datatype="int" comment="Count of unique group ids">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_all_group_ids:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1" datatype="int" comment="inactive days expiration"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" version="1" datatype="int" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" version="1" datatype="int" comment="Count of unique username rows retrieved from /etc/passwd">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs">
          <oval-def:regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1" datatype="int" comment="Maximum password age"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs">
          <oval-def:regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1" datatype="int" comment="Minimum password age in days"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs">
          <oval-def:regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1" datatype="int" comment="Password minimum length"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_maximum_age_root:var:1" version="1" datatype="int" comment="maximum password age in days"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1" datatype="int" comment="External variable"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs">
          <oval-def:regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_last_change_is_in_past_time_in_secs:var:1" version="1" datatype="int" comment="last change field of shadow entry in seconds">
          <oval-def:arithmetic arithmetic_operation="multiply">
            <oval-def:object_component object_ref="oval:ssg-object_accounts_password_last_change_is_in_past:obj:1" item_field="chg_lst"/>
            <oval-def:literal_component datatype="int">86400</oval-def:literal_component>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_last_change_is_in_past_time_diff:var:1" version="1" datatype="int" comment="time difference between the last change field of shadow entry and the current time">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_password_last_change_is_in_past_time_in_secs:var:1"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_password_last_change_is_in_past_current_epoch:var:1" version="1" datatype="int" comment="the current time in seconds since epoch">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:literal_component datatype="int">0</oval-def:literal_component>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_password_pam_unix_rounds:var:1" version="1" datatype="int" comment="number of passwords hashing rounds"/>
        <oval-def:local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" version="1" datatype="string" comment="GIDs from /etc/group">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_ensure_pam_wheel_group_regex:var:1" version="1" datatype="string" comment="Regex to match the whole group line in /etc/group">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:escape_regex>
              <oval-def:variable_component var_ref="oval:ssg-var_pam_wheel_group_for_su:var:1"/>
            </oval-def:escape_regex>
            <oval-def:literal_component>:[^:]+:[0-9]+:.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_pam_wheel_group_for_su:var:1" version="1" datatype="string" comment="name of the group used by pam_wheel.so group option"/>
        <oval-def:local_variable id="oval:ssg-var_no_password_auth_for_systemaccounts_usernames:var:1" version="1" datatype="string" comment="Variable including usernames of system accounts">
          <oval-def:object_component item_field="username" object_ref="oval:ssg-object_no_password_auth_for_systemaccounts_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_uid_min_value:var:1" version="1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs">
          <oval-def:regex_capture pattern="UID_MIN[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" version="1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs">
          <oval-def:regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" version="1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs">
          <oval-def:regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_fail_delay:var:1" version="1" datatype="int" comment="Expected fail_delay"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1" datatype="int" comment="maximum number of concurrent logins per user"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_tmout_instances:var:1" version="1" datatype="int" comment="Count of TMOUT instances">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_accounts_tmout_all_tmout_instances:obj:1" item_field="text"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_tmout:var:1" version="1" datatype="int" comment="external variable for TMOUT"/>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_user_dot_group_ownership_home_dirs_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_group_ownership_home_dirs_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_user_dot_group_ownership_gids_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_group_ownership_gids_local_interactive_users:obj:1"/>
            <oval-def:literal_component>:)(?:[^:]*:){2}([^:]+):(?:[^:]*:){2}[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_dot_group_ownership_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_group_ownership_home_dirs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_dot_group_ownership_gids:var:1" version="1" datatype="int" comment="List of interactive users gids">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_group_ownership_gids:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_dot_no_world_writable_programs_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="home_dir" object_ref="oval:ssg-object_accounts_user_dot_no_world_writable_programs_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_world_writable_programs:var:1" version="1" datatype="string" comment="Variable including all world writable programs">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_world_writable_programs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_world_writable_programs_regex:var:1" version="1" datatype="string" comment="Regex including all world writable programs">
          <oval-def:concat>
            <oval-def:literal_component>^[^#]*</oval-def:literal_component>
            <oval-def:escape_regex>
              <oval-def:variable_component var_ref="oval:ssg-var_world_writable_programs:var:1"/>
            </oval-def:escape_regex>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_user_initialization_files_regex:var:1" version="1" datatype="string" comment="User initialization files"/>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_user_dot_user_ownership_home_dirs_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_user_ownership_home_dirs_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_user_dot_user_ownership_uids_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_user_ownership_uids_local_interactive_users:obj:1"/>
            <oval-def:literal_component>:)(?:[^:]*:)([^:]+):(?:[^:]*:){3}[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_dot_user_ownership_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_user_ownership_home_dirs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_dot_user_ownership_uids:var:1" version="1" datatype="int" comment="List of interactive users uids">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_dot_user_ownership_uids:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_user_interactive_home_directory_exists_objects_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_interactive_home_directory_exists_objects_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_list:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_user_interactive_home_directory_exists_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1" version="1" datatype="int" comment="Variable including expected count of home dirs present on the system">
          <oval-def:count>
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_list:var:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count_fs:var:1" version="1" datatype="int" comment="Variable including number of home dirs present on file system">
          <oval-def:count>
            <oval-def:object_component item_field="path" object_ref="oval:ssg-object_accounts_user_interactive_home_directory_exists_dirs_fs:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_users_home_files_groupownership_home_dirs_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_groupownership_home_dirs_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_users_home_files_groupownership_gids_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_groupownership_gids_local_interactive_users:obj:1"/>
            <oval-def:literal_component>:)(?:[^:]*:){2}([^:]+):(?:[^:]*:){2}[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_users_home_files_groupownership_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_groupownership_home_dirs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_users_home_files_groupownership_gids:var:1" version="1" datatype="int" comment="List of interactive users gids">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_groupownership_gids:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_users_home_files_ownership_home_dirs_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_ownership_home_dirs_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_users_home_files_ownership_uids_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_ownership_uids_local_interactive_users:obj:1"/>
            <oval-def:literal_component>:)(?:[^:]*:)([^:]+):(?:[^:]*:){3}[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_users_home_files_ownership_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_ownership_home_dirs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_users_home_files_ownership_uids:var:1" version="1" datatype="int" comment="List of interactive users uids">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_ownership_uids:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_users_home_files_permissions_home_dirs_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_permissions_home_dirs_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_users_home_files_permissions_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_users_home_files_permissions_home_dirs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_file_groupownership_home_directories_home_dirs_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_groupownership_home_directories_home_dirs_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_file_groupownership_home_directories_gids_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_groupownership_home_directories_gids_local_interactive_users:obj:1"/>
            <oval-def:literal_component>:)(?:[^:]*:){2}([^:]+):(?:[^:]*:){2}[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_groupownership_home_directories_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from primary interactive groups">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_groupownership_home_directories_home_dirs:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_groupownership_home_directories_gids:var:1" version="1" datatype="int" comment="Variable including all gids from primary interactive group">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_groupownership_home_directories_gids:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permission_user_init_files_home_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="home_dir" object_ref="oval:ssg-object_file_permission_user_init_files_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_file_permissions_home_directories_objects_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_permissions_home_directories_objects_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_home_directories_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_file_permissions_home_directories_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_home_dirs_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="home_dir" object_ref="oval:ssg-object_file_permissions_home_dirs_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1" datatype="string" comment="Split the PATH on the : delimiter">
          <oval-def:split delimiter=":">
            <oval-def:object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_bashrc:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/bashrc">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_bashrc:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/bashrc">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_bashrc:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/bashrc">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_bashrc_umask_as_number:var:1" version="1" datatype="int" comment="/etc/bashrc umask converted from string to a number">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_bashrc:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_bashrc:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_bashrc:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_csh_cshrc:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/csh.cshrc">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_csh_cshrc:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/csh.cshrc">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_csh_cshrc:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/csh.cshrc">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1" version="1" datatype="int" comment="/etc/csh.cshrc umask converted from string to a number">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_csh_cshrc:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_csh_cshrc:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_csh_cshrc:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/login.defs">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/login.defs">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/login.defs">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" version="1" datatype="int" comment="/etc/login.defs umask converted from string to a number">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="first octal digit of umask value(s)">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="second octal digit of umask value(s)">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="third octal digit of umask value(s)">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" version="1" datatype="int" comment="umask value converted from string to a number">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_object_accounts_umask_interactive_users_objects_regex:var:1" version="1" datatype="string" comment="usernames rows retrieved from /etc/passwd">
          <oval-def:concat>
            <oval-def:literal_component>^(?:</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_umask_interactive_users_objects_local_interactive_users:obj:1"/>
            <oval-def:literal_component>):(?:[^:]*:){4}([^:]+):[^:]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_umask_interactive_users_dirs:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_umask_interactive_users_objects:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_user_accounts:var:1" version="1" datatype="string" comment="Variable           including all system usernames">
          <oval-def:object_component item_field="username" object_ref="oval:ssg-object_user_accounts:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_kernel_config_default_mmap_min_addr_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_kernel_config_default_mmap_min_addr_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_default_mmap_min_addr:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dir_perms_world_writable_sticky_bits_local_mountpoints:var:1" version="1" datatype="string" comment="Mount points for local devices">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_dir_perms_world_writable_sticky_bits_local_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_local_mountpoints:var:1" version="1" datatype="string" comment="Mount points for local devices">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_file_permissions_unauthorized_sgid_local_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_all_sgid_files:var:1" version="1" datatype="string" comment="all files with sgid set">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_file_permissions_unauthorized_sgid_all_sgid_files:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" version="1" datatype="string" comment="all files with sgid set that are managed by a RPM package">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_file_permissions_unauthorized_sgid_rpms:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_local_mountpoints:var:1" version="1" datatype="string" comment="Mount points for local devices">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_file_permissions_unauthorized_suid_local_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_all_suid_files:var:1" version="1" datatype="string" comment="all files with suid set">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_file_permissions_unauthorized_suid_all_suid_files:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" version="1" datatype="string" comment="all files with suid set that are managed by a RPM package">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-object_file_permissions_unauthorized_suid_rpms:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_world_writable_local_mountpoints:var:1" version="1" datatype="string" comment="Mount points for local devices">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_file_permissions_unauthorized_world_writable_local_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_all_local_gids:var:1" version="1" datatype="int" comment="all GIDs extracted from /etc/group on the target system">
          <oval-def:object_component object_ref="oval:ssg-object_etc_group:obj:1" item_field="subexpression"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_all_local_gids_with_usrlib:var:1" version="1" datatype="int" comment="all GIDs extracted from /etc/group on the target system">
          <oval-def:object_component object_ref="oval:ssg-object_all_gids_with_usrlib:obj:1" item_field="subexpression"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_ungroupowned_local_mountpoints:var:1" version="1" datatype="string" comment="Mount points for local devices">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_file_permissions_ungroupowned_local_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_no_files_unowned_by_user_uids_list:var:1" version="1" datatype="int" comment="List of valid user ids">
          <oval-def:object_component item_field="user_id" object_ref="oval:ssg-object_no_files_unowned_by_user_all_users:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_no_files_unowned_by_user_local_mountpoints:var:1" version="1" datatype="string" comment="Mount points for local devices">
          <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_no_files_unowned_by_user_local_partitions:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_sysctl_kernel_core_pattern_empty_string_counter:var:1" version="1" datatype="int" comment="Count unique sysctls">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_sysctl_kernel_core_pattern_empty_string_safe_symlinks:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-var_object_symlink_sysctl_kernel_core_pattern_empty_string:obj:1" item_field="value"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_blank_path_sysctl_kernel_core_pattern_empty_string:var:1" version="1" datatype="string" comment="Blank string">
          <oval-def:literal_component datatype="string"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_symlinks_sysctl_kernel_core_pattern_empty_string:var:1" version="1" datatype="string" comment="Unique list of symlink conf files">
          <oval-def:unique>
            <oval-def:object_component object_ref="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_symlinks:obj:1" item_field="filepath"/>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_conf_files_sysctl_kernel_core_pattern_empty_string:var:1" version="1" datatype="string" comment="List of conf files">
          <oval-def:object_component object_ref="oval:ssg-object_sysctl_kernel_core_pattern_empty_string_static_set_sysctls_unfiltered:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_dev_device_files:var:1" version="1" datatype="string" comment="all device files within /dev directory">
          <oval-def:object_component object_ref="oval:ssg-object_dev_device_files:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_selinux_policy_name:var:1" version="1" datatype="string" comment="External variable: name of selinux policy in /etc/selinux/config"/>
        <oval-def:external_variable id="oval:ssg-var_selinux_state:var:1" version="1" datatype="string" comment="external variable for selinux state"/>
        <oval-def:local_variable id="oval:ssg-var_dconf_local_db_modified_time:var:1" version="1" datatype="string" comment="When the 'local' dconf DB has been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_local_db:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" version="1" datatype="int" comment="When dconf keyfiles in the 'local' tree have been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_local_config:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-inactivity_timeout_value:var:1" version="1" datatype="int" comment="inactivity timeout variable"/>
        <oval-def:external_variable id="oval:ssg-var_screensaver_lock_delay:var:1" version="1" datatype="int" comment="screensaver lock delay variable"/>
        <oval-def:local_variable id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" version="1" datatype="int" comment="Age of /etc/crypto-policies/state/current">
          <oval-def:object_component object_ref="oval:ssg-crypto_policies_current_file:obj:1" item_field="m_time"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1" version="1" datatype="int" comment="Age of /etc/crypto-policies/config">
          <oval-def:object_component object_ref="oval:ssg-crypto_policies_config_file:obj:1" item_field="m_time"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_system_crypto_policy:var:1" version="1" datatype="string" comment="defined crypto policy"/>
        <oval-def:local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1" version="1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy">
          <oval-def:object_component item_field="canonical_path" object_ref="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" version="1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy">
          <oval-def:object_component item_field="canonical_path" object_ref="oval:ssg-object_kerberos_crypto_policy_backend:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sshd_ciphers_crypto:var:1" version="1" datatype="string" comment="The regex of the directive">
          <oval-def:concat>
            <oval-def:literal_component>Ciphers </oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_ciphers:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sshd_macs_crypto:var:1" version="1" datatype="string" comment="The regex of the directive">
          <oval-def:concat>
            <oval-def:literal_component>MACs </oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_macs:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sshd_macs_crypto_opensshserver:var:1" version="1" datatype="string" comment="The regex of the directive">
          <oval-def:concat>
            <oval-def:literal_component>-oMACs=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_macs:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" version="1" datatype="string" comment="Absolute path of Aide build database file">
          <oval-def:concat>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
            <oval-def:literal_component>/</oval-def:literal_component>
            <oval-def:object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sudo_dedicated_group_regex_for_gid:var:1" version="1" datatype="string" comment="Build the regex for the group ID based on the variable">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_sudo_dedicated_group:var:1"/>
            <oval-def:literal_component>:x:(\d+):.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_sudo_dedicated_group:var:1" version="1" datatype="string" comment="Name of sudo dedicated group"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_dcredit:var:1" version="3" datatype="int" comment="External variable for pam_dcredit"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_dictcheck:var:1" version="3" datatype="int" comment="External variable for pam_dictcheck"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_difok:var:1" version="3" datatype="int" comment="External variable for pam_difok"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_lcredit:var:1" version="3" datatype="int" comment="External variable for pam_lcredit"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_maxclassrepeat:var:1" version="3" datatype="int" comment="External variable for pam_maxclassrepeat"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_maxrepeat:var:1" version="3" datatype="int" comment="External variable for pam_maxrepeat"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_minclass:var:1" version="3" datatype="int" comment="External variable for pam_minclass"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_minlen:var:1" version="3" datatype="int" comment="External variable for pam_minlen"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_ocredit:var:1" version="3" datatype="int" comment="External variable for pam_ocredit"/>
        <oval-def:external_variable id="oval:ssg-var_password_pam_ucredit:var:1" version="3" datatype="int" comment="External variable for pam_ucredit"/>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_unix_regex:var:1" version="2" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^\s*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_auth_regex:var:1" version="2" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_account_regex:var:1" version="2" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_pam_faillock_deny_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so deny entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny_faillock_conf_deny_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify deny entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*deny[\s]*=[\s]*([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" version="1" datatype="int" comment="external variable to use"/>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_unix_regex:var:1" version="2" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^\s*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_auth_regex:var:1" version="2" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_account_regex:var:1" version="2" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_pam_faillock_fail_interval_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so fail_interval entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval_faillock_conf_fail_interval_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify fail_interval entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*fail_interval[\s]*=[\s]*([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" version="1" datatype="int" comment="external variable to use"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" version="1" datatype="int" comment="external variable to use"/>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_unix_regex:var:1" version="2" datatype="string" comment="regex to identify pam_unix.so in auth section of pam files">
          <oval-def:value>^\s*auth\N+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_auth_regex:var:1" version="2" datatype="string" comment="regex to identify pam_faillock.so entries in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_account_regex:var:1" version="2" datatype="string" comment="regex to identify pam_faillock.so entry in account section of pam files">
          <oval-def:value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_pam_faillock_unlock_time_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify pam_faillock.so unlock_time entry in auth section of pam files">
          <oval-def:value>^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time_faillock_conf_unlock_time_parameter_regex:var:1" version="1" datatype="string" comment="regex to identify unlock_time entry in /etc/security/faillock.conf">
          <oval-def:value>^[\s]*unlock_time[\s]*=[\s]*([0-9]+)</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_passwords_pam_faillock_dir_path_pattern:var:1" version="1" datatype="string" comment="The composite pattern used to detect if audit as been configured">
          <oval-def:concat>
            <oval-def:literal_component>^\-w[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_passwords_pam_faillock_dir:var:1"/>
            <oval-def:literal_component>[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_dir:var:1" version="1" datatype="string" comment="Faillock directory"/>
        <oval-def:local_variable id="oval:ssg-lastlog_path_pattern:var:1" version="1" datatype="string" comment="The composite pattern used to detect if audit as been configured">
          <oval-def:concat>
            <oval-def:literal_component>^\-w[\s]+</oval-def:literal_component>
            <oval-def:literal_component>\/var\/log\/lastlog</oval-def:literal_component>
            <oval-def:literal_component>[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-tallylog_path_pattern:var:1" version="1" datatype="string" comment="The composite pattern used to detect if audit as been configured">
          <oval-def:concat>
            <oval-def:literal_component>^\-w[\s]+</oval-def:literal_component>
            <oval-def:literal_component>\/var\/log\/tallylog</oval-def:literal_component>
            <oval-def:literal_component>[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_ftruncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_open_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_openat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_truncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sudo_log_path_pattern:var:1" version="1" datatype="string" comment="The composite pattern used to detect if audit as been configured">
          <oval-def:concat>
            <oval-def:literal_component>^\-w[\s]+</oval-def:literal_component>
            <oval-def:literal_component>\/var\/log\/sudo.log</oval-def:literal_component>
            <oval-def:literal_component>[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_ipsecd_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_ipsecd_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_iptables_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_iptables_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_nftables_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_nftables_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_selinux_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_selinux_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_sudoersd_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_sudoersd_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownerdirectory_groupowner_etc_sysctld_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownerdirectory_groupowner_etc_sysctld_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_disable_host_auth:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_disable_host_auth:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_crypttab_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupowner_etc_crypttab_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_ipsec_conf_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupowner_etc_ipsec_conf_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_ipsec_secrets_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupowner_etc_ipsec_secrets_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_sestatus_conf_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupowner_etc_sestatus_conf_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_etc_sudoers_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupowner_etc_sudoers_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupowner_systemmap_uid_root:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupowner_systemmap_uid_root:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dedicated_groupownership_sshd_private_key_uid_ssh_keys:var:1" version="1" datatype="int" comment="Count of all group names (including duplicates if any)">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_dedicated_groupownership_sshd_private_key_uid_ssh_keys:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_regex_l1tf_var_l1tf_options:var:1" version="1" datatype="string" comment="Regex that matches l1tf with value var_l1tf_options">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?l1tf=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_l1tf_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_l1tf_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_mds_var_mds_options:var:1" version="1" datatype="string" comment="Regex that matches mds with value var_mds_options">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?mds=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_mds_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_mds_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_rng_core_default_quality_var_rng_core_default_quality:var:1" version="1" datatype="string" comment="Regex that matches rng_core.default_quality with value var_rng_core_default_quality">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?rng_core.default_quality=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rng_core_default_quality:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_rng_core_default_quality:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_slub_debug_var_slub_debug_options:var:1" version="1" datatype="string" comment="Regex that matches slub_debug with value var_slub_debug_options">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?slub_debug=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_slub_debug_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_slub_debug_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-local_var_regex_spec_store_bypass_disable_var_spec_store_bypass_disable_options:var:1" version="1" datatype="string" comment="Regex that matches spec_store_bypass_disable with value var_spec_store_bypass_disable_options">
          <oval-def:concat>
            <oval-def:literal_component>^(?:.*\s)?spec_store_bypass_disable=</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_spec_store_bypass_disable_options:var:1"/>
            <oval-def:literal_component>(?:\s.*)?$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_spec_store_bypass_disable_options:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-local_var_config_acpi_custom_method_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_acpi_custom_method_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_acpi_custom_method_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_acpi_custom_method:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_arm64_sw_ttbr0_pan_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_arm64_sw_ttbr0_pan:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_binfmt_misc_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_binfmt_misc_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_binfmt_misc_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_binfmt_misc:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_bug_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_bug_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_bug_on_data_corruption_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_bug_on_data_corruption_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_bug_on_data_corruption:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_compat_brk_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_brk_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_compat_brk_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_brk:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_compat_vdso_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_vdso_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_compat_vdso_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_compat_vdso:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_credentials_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_credentials_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_credentials_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_credentials:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_fs_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_fs_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_fs_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_fs:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_list_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_list_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_list_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_list:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_notifiers_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_notifiers_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_notifiers_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_notifiers:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_sg_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_sg_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_sg_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_sg:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_wx_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_wx_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_debug_wx_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_debug_wx:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_devkmem_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_devkmem_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_devkmem_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_devkmem:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_fortify_source_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_fortify_source_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_fortify_source_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_fortify_source:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_latent_entropy_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_latent_entropy:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_randstruct_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_randstruct_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_randstruct:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_stackleak_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_stackleak_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_stackleak:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_gcc_plugin_structleak_byref_all_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_gcc_plugin_structleak_byref_all:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_hardened_usercopy_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_hardened_usercopy_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_hardened_usercopy_fallback_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_hardened_usercopy_fallback_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hardened_usercopy_fallback:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_hibernation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hibernation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_hibernation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_hibernation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_ia32_emulation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ia32_emulation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_ia32_emulation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ia32_emulation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_ipv6_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ipv6_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_ipv6_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_ipv6:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_kexec_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_kexec_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_kexec_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_kexec:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_ptys_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_ptys_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_ptys_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_ptys:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_vsyscall_emulate_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_emulate:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_vsyscall_none_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_vsyscall_none_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_none:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_legacy_vsyscall_xonly_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_legacy_vsyscall_xonly:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_modify_ldt_syscall_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_modify_ldt_syscall_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_modify_ldt_syscall:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_all_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_all_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_all_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_all:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_force_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_force_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_force_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_force:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_hash_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_hash_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_hash_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_hash:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_kernel_config_module_sig_hash:var:1" version="1" datatype="string" comment="Value for kernel CONFIG_MODULE_SIG_HASH setting"/>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_key_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_key_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_key_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_key:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_kernel_config_module_sig_key:var:1" version="1" datatype="string" comment="Value for kernel CONFIG_MODULE_SIG_KEY setting"/>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_sha512_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_sha512_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_module_sig_sha512_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_module_sig_sha512:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_poisoning_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_poisoning_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_poisoning_no_sanity_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_poisoning_no_sanity_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_no_sanity:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_poisoning_zero_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_zero_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_poisoning_zero_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_poisoning_zero:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_table_isolation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_table_isolation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_page_table_isolation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_page_table_isolation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_panic_on_oops_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_on_oops_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_panic_on_oops_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_on_oops:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_panic_timeout_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_timeout_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_panic_timeout_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_panic_timeout:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_kernel_config_panic_timeout:var:1" version="1" datatype="string" comment="Value for kernel CONFIG_PANIC_TIMEOUT setting"/>
        <oval-def:local_variable id="oval:ssg-local_var_config_proc_kcore_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_proc_kcore_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_proc_kcore_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_proc_kcore:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_randomize_base_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_base_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_randomize_base_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_base:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_randomize_memory_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_memory_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_randomize_memory_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_randomize_memory:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_refcount_full_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_refcount_full_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_refcount_full_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_refcount_full:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_retpoline_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_retpoline_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_retpoline_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_retpoline:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_sched_stack_end_check_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_sched_stack_end_check_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_sched_stack_end_check_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_sched_stack_end_check:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_seccomp_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_seccomp_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_seccomp_filter_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp_filter_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_seccomp_filter_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_seccomp_filter:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_dmesg_restrict_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_dmesg_restrict_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_dmesg_restrict:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_writable_hooks_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_writable_hooks_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_writable_hooks_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_writable_hooks:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_yama_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_yama_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_security_yama_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_security_yama:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slab_freelist_hardened_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slab_freelist_hardened_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_hardened:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slab_freelist_random_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_random_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slab_freelist_random_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_freelist_random:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slab_merge_default_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_merge_default_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slab_merge_default_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slab_merge_default:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slub_debug_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slub_debug_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_slub_debug_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_slub_debug:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_stackprotector_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_stackprotector_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_stackprotector_strong_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector_strong_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_stackprotector_strong_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_stackprotector_strong:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_strict_kernel_rwx_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_strict_kernel_rwx_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_kernel_rwx:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_strict_module_rwx_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_module_rwx_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_strict_module_rwx_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_strict_module_rwx:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_syn_cookies_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_syn_cookies_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_syn_cookies_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_syn_cookies:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_unmap_kernel_at_el0_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_unmap_kernel_at_el0_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_unmap_kernel_at_el0:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_vmap_stack_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_vmap_stack_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_vmap_stack_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_vmap_stack:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_x86_vsyscall_emulation_count_kernels_installed:var:1" version="1" datatype="int" comment="Count number of kernels installed">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation_files:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_config_x86_vsyscall_emulation_count_compliant_configs:var:1" version="1" datatype="int" comment="Count number of configs found">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component object_ref="oval:ssg-object_kernel_config_x86_vsyscall_emulation:obj:1" item_field="filepath"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_atm_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_bluetooth_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_can_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_cramfs_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_dccp_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_firewire-core_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_rds_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_sctp_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_squashfs_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_tipc_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_udf_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_usb-storage_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_kernel_module_uvcvideo_paths:var:1" version="1" datatype="string" comment="Other paths where kernel modules can be configured">
          <oval-def:value>/etc/modprobe.d</oval-def:value>
          <oval-def:value>/etc/modules-load.d</oval-def:value>
          <oval-def:value>/run/modprobe.d</oval-def:value>
          <oval-def:value>/run/modules-load.d</oval-def:value>
          <oval-def:value>/usr/lib/modprobe.d</oval-def:value>
          <oval-def:value>/usr/lib/modules-load.d</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_grpquota_regex:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:concat>
            <oval-def:literal_component>^(?:(?!nobody).*)?:.*?:[1-9]\d{3,}:.*?:.*?:(</oval-def:literal_component>
            <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_home_partition_all_partitions_grpquota:obj:1"/>
            <oval-def:literal_component>).*?:.*</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_grpquota:var:1" version="1" datatype="string" comment="This variable collects all partition mount points for interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_home_partitions_mount_points_grpquota:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_noexec_regex:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:concat>
            <oval-def:literal_component>^(?:(?!nobody).*)?:.*?:[1-9]\d{3,}:.*?:.*?:(</oval-def:literal_component>
            <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_home_partition_all_partitions_noexec:obj:1"/>
            <oval-def:literal_component>).*?:.*</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_noexec:var:1" version="1" datatype="string" comment="This variable collects all partition mount points for interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_home_partitions_mount_points_noexec:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_nosuid_regex:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:concat>
            <oval-def:literal_component>^(?:(?!nobody).*)?:.*?:[1-9]\d{3,}:.*?:.*?:(</oval-def:literal_component>
            <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_home_partition_all_partitions_nosuid:obj:1"/>
            <oval-def:literal_component>).*?:.*</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_nosuid:var:1" version="1" datatype="string" comment="This variable collects all partition mount points for interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_home_partitions_mount_points_nosuid:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_usrquota_regex:var:1" version="1" datatype="string" comment="Variable including all home dirs from interactive users">
          <oval-def:concat>
            <oval-def:literal_component>^(?:(?!nobody).*)?:.*?:[1-9]\d{3,}:.*?:.*?:(</oval-def:literal_component>
            <oval-def:object_component item_field="mount_point" object_ref="oval:ssg-object_home_partition_all_partitions_usrquota:obj:1"/>
            <oval-def:literal_component>).*?:.*</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_home_partitions_mount_points_usrquota:var:1" version="1" datatype="string" comment="This variable collects all partition mount points for interactive users">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_home_partitions_mount_points_usrquota:obj:1"/>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1" version="1" datatype="string" comment="CD/DVD drive allowed alternative names">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_removable_partition:var:1" version="1" datatype="string" comment="removable partition"/>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1" version="1" datatype="string" comment="CD/DVD drive allowed alternative names">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1" version="1" datatype="string" comment="CD/DVD drive allowed alternative names">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_groupownership_include_config_regex:var:1" version="1" datatype="string" comment="rsyslog's include config values converted to regex.">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rsyslog_files_groupownership_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_groupownership_syslog_config:var:1" version="1" datatype="string" comment="Main rsyslog configuration file.">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_groupownership_all_conf_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection.">
          <oval-def:object_component object_ref="oval:ssg-object_var_rsyslog_files_groupownership_all_conf_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_groupownership_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog log files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rsyslog_files_groupownership_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_groupownership_groupowner_gid:var:1" version="1" datatype="int" comment="GID of group root">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_rsyslog_files_groupownership_groupowner_gid:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_ownership_include_config_regex:var:1" version="1" datatype="string" comment="rsyslog's include config values converted to regex.">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rsyslog_files_ownership_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_ownership_syslog_config:var:1" version="1" datatype="string" comment="Main rsyslog configuration file.">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_ownership_all_conf_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection.">
          <oval-def:object_component object_ref="oval:ssg-object_var_rsyslog_files_ownership_all_conf_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_ownership_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog log files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rsyslog_files_ownership_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_ownership_owner_uid:var:1" version="1" datatype="int" comment="UID of user root">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_rsyslog_files_ownership_owner_uid:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_permissions_include_config_regex:var:1" version="1" datatype="string" comment="rsyslog's include config values converted to regex.">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rsyslog_files_permissions_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_permissions_syslog_config:var:1" version="1" datatype="string" comment="Main rsyslog configuration file.">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_permissions_all_conf_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection.">
          <oval-def:object_component object_ref="oval:ssg-object_var_rsyslog_files_permissions_all_conf_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rsyslog_files_permissions_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog log files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rsyslog_files_permissions_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_auditadm_exec_content:var:1" version="1" datatype="boolean" comment="external variable for auditadm_exec_content"/>
        <oval-def:external_variable id="oval:ssg-var_authlogin_nsswitch_use_ldap:var:1" version="1" datatype="boolean" comment="external variable for authlogin_nsswitch_use_ldap"/>
        <oval-def:external_variable id="oval:ssg-var_authlogin_radius:var:1" version="1" datatype="boolean" comment="external variable for authlogin_radius"/>
        <oval-def:external_variable id="oval:ssg-var_deny_execmem:var:1" version="1" datatype="boolean" comment="external variable for deny_execmem"/>
        <oval-def:external_variable id="oval:ssg-var_kerberos_enabled:var:1" version="1" datatype="boolean" comment="external variable for kerberos_enabled"/>
        <oval-def:external_variable id="oval:ssg-var_polyinstantiation_enabled:var:1" version="1" datatype="boolean" comment="external variable for polyinstantiation_enabled"/>
        <oval-def:external_variable id="oval:ssg-var_secure_mode_insmod:var:1" version="1" datatype="boolean" comment="external variable for secure_mode_insmod"/>
        <oval-def:external_variable id="oval:ssg-var_selinuxuser_execheap:var:1" version="1" datatype="boolean" comment="external variable for selinuxuser_execheap"/>
        <oval-def:external_variable id="oval:ssg-var_selinuxuser_execmod:var:1" version="1" datatype="boolean" comment="external variable for selinuxuser_execmod"/>
        <oval-def:external_variable id="oval:ssg-var_selinuxuser_execstack:var:1" version="1" datatype="boolean" comment="external variable for selinuxuser_execstack"/>
        <oval-def:external_variable id="oval:ssg-var_ssh_sysadm_login:var:1" version="1" datatype="boolean" comment="external variable for ssh_sysadm_login"/>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_allow_only_protocol2:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_allow_only_protocol2:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_regex_sshd_disable_compression:var:1" version="1" datatype="string" comment="Regex that matches exact value represented by var_sshd_disable_compression XCCDF variable">
          <oval-def:variable_component var_ref="oval:ssg-var_sshd_disable_compression:var:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_sshd_disable_compression:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_compression:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_compression:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_empty_passwords:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_empty_passwords:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_gssapi_auth:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_gssapi_auth:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_kerb_auth:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_kerb_auth:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_pubkey_auth:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_pubkey_auth:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_rhosts:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_rhosts:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_rhosts_rsa:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_rhosts_rsa:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_root_login:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_root_login:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_root_password_login:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_root_password_login:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_tcp_forwarding:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_tcp_forwarding:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_user_known_hosts:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_user_known_hosts:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_disable_x11_forwarding:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_disable_x11_forwarding:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_do_not_permit_user_env:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_do_not_permit_user_env:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_gssapi_auth:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_gssapi_auth:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_pam:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_pam:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_pubkey_auth:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_pubkey_auth:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_strictmodes:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_strictmodes:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_warning_banner:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_warning_banner:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_warning_banner_net:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_warning_banner_net:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_enable_x11_forwarding:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_enable_x11_forwarding:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_print_last_log:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_print_last_log:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_regex_sshd_set_keepalive:var:1" version="1" datatype="int" comment="Regex that matches exact value represented by var_sshd_set_keepalive XCCDF variable">
          <oval-def:variable_component var_ref="oval:ssg-var_sshd_set_keepalive:var:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_sshd_set_keepalive:var:1" version="1" datatype="int" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_set_keepalive:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_set_keepalive:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_set_keepalive_0:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_set_keepalive_0:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_set_loglevel_info:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_set_loglevel_info:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_set_loglevel_verbose:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_set_loglevel_verbose:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-local_var_regex_sshd_use_priv_separation:var:1" version="1" datatype="string" comment="Regex that matches exact value represented by var_sshd_priv_separation XCCDF variable">
          <oval-def:variable_component var_ref="oval:ssg-var_sshd_priv_separation:var:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_sshd_priv_separation:var:1" version="1" datatype="string" comment="Variable defining the value the argument should have"/>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_use_priv_separation:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_use_priv_separation:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_sshd_config_included_files_sshd_x11_use_localhost:var:1" version="1" datatype="string" comment="Include value converted to regex">
          <oval-def:concat>
            <oval-def:literal_component>^(/etc/ssh/(?!/))?</oval-def:literal_component>
            <oval-def:substring substring_start="2" substring_length="-1">
              <oval-def:unique>
                <oval-def:glob_to_regex>
                  <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_sshd_include_value_sshd_x11_use_localhost:obj:1"/>
                </oval-def:glob_to_regex>
              </oval-def:unique>
            </oval-def:substring>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_sudo_logfile:var:1" version="1" datatype="string" comment="Variable value for sudo logfile "/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.accept_redirects"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.accept_source_route"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_arp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.arp_filter"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_arp_ignore_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.arp_ignore"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_forwarding_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.forwarding"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.log_martians"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.secure_redirects"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_shared_media_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.shared_media"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.accept_redirects"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.accept_source_route"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.log_martians"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.rp_filter"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.secure_redirects"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_shared_media_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.shared_media"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_tcp_rfc1337_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.tcp_rfc1337"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.tcp_syncookies"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_defrtr"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_pinfo"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_rtr_pref"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_redirects"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_source_route"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.autoconf"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.forwarding"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.max_addresses"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.router_solicitations"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_defrtr"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_pinfo"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_rtr_pref"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_redirects"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_source_route"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.autoconf"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.max_addresses"/>
        <oval-def:external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.router_solicitations"/>
        <oval-def:constant_variable id="oval:ssg-var_pam_pwquality_config_path:var:1" version="1" datatype="string" comment="correct path for pam_pwquality.so check">
          <oval-def:value>/etc/pam.d/system-auth</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-audit_log_file_path:var:1" version="1" datatype="string" comment="path to audit log files">
          <oval-def:regex_capture pattern="^log_file\s*=\s*(.*)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_auditd_conf_log_file:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" version="1" datatype="string" comment="CD/DVD drive allowed alternative names">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable id="oval:ssg-sshd_required:var:1" version="1" datatype="int" comment="May be defined by Profiles to explicitly say if sshd is required or not"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_user_umask:var:1" version="1" datatype="string" comment="Value of var_accounts_user_umask (the required umask) as string"/>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="First octal digit of umask from var_accounts_user_umask">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="Second octal digit of umask from var_accounts_user_umask">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="Third octal digit of umask from var_accounts_user_umask">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" version="1" datatype="int" comment="var_accounts_user_umask umask converted from string to a number">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
      </oval-def:variables>
    </oval-def:oval_definitions>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-ol9-ocil.xml" timestamp="2025-05-05T17:00:00">
    <ocil:ocil>
      <ocil:generator>
        <ocil:product_name>build_shorthand.py from SCAP Security Guide</ocil:product_name>
        <ocil:product_version>ssg: 0.1.76</ocil:product_version>
        <ocil:schema_version>2.0</ocil:schema_version>
        <ocil:timestamp>2025-05-06T00:00:00</ocil:timestamp>
      </ocil:generator>
      <ocil:questionnaires>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled In Main yum Configuration</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_etc_nftables_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/nftables Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_etc_nftables_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_users_home_files_permissions_ocil:questionnaire:1">
          <ocil:title>All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_users_home_files_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_rng_core_default_quality_argument_ocil:questionnaire:1">
          <ocil:title>Configure the confidence in TPM for entropy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_rng_core_default_quality_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_talk-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall talk-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_talk-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_vsyscall_xonly_ocil:questionnaire:1">
          <ocil:title>Disable vsyscall emulate execution only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_vsyscall_xonly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1">
          <ocil:title>Disable RDS Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_rds_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_relayhost_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail through a specific host</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_relayhost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_monthly_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns cron.monthly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_monthly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-tftpd_uses_secure_mode_ocil:questionnaire:1">
          <ocil:title>Ensure tftp Daemon Uses Secure Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-tftpd_uses_secure_mode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-etc_system_fips_exists_ocil:questionnaire:1">
          <ocil:title>Ensure '/etc/system-fips' exists</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-etc_system_fips_exists_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_squid_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall squid Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_squid_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_vsyscall_argument_ocil:questionnaire:1">
          <ocil:title>Disable vsyscalls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_vsyscall_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_sha512_ocil:questionnaire:1">
          <ocil:title>Sign kernel modules with SHA-512</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Addressing on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_ldap_start_tls_ocil:questionnaire:1">
          <ocil:title>Configure SSSD LDAP Backend to Use TLS For All Transactions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_ldap_start_tls_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to Removable Media Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_groupowner_etc_sysctld_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/sysctl.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_groupowner_etc_sysctld_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_sudoers_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/sudoers File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_sudoers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Accepting ICMP Redirects for All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Algorithm in /etc/libuser.conf</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Symlinks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_etc_ipsecd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/ipsec.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_etc_ipsecd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1">
          <ocil:title>Ensure that System Accounts Do Not Run a Shell Upon Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1">
          <ocil:title>Ensure cron Is Logging To Rsyslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_cron_logging_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_dnf-automatic_installed_ocil:questionnaire:1">
          <ocil:title>Install dnf-automatic Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_dnf-automatic_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1">
          <ocil:title>Limit the Number of Concurrent Login Sessions Allowed Per User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-clean_components_post_updating_ocil:questionnaire:1">
          <ocil:title>Ensure yum Removes Previous Package Versions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-clean_components_post_updating_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_dhcp_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall DHCP Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_dhcp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on System.map Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_systemmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_seccomp_filter_ocil:questionnaire:1">
          <ocil:title>Enable use of Berkeley Packet Filter with seccomp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_seccomp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-require_emergency_target_auth_ocil:questionnaire:1">
          <ocil:title>Require Authentication for Emergency Systemd Target</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-require_emergency_target_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Count Max</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_keepalive_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to Non-Root Local Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_user_dot_no_world_writable_programs_ocil:questionnaire:1">
          <ocil:title>User Initialization Files Must Not Run World-Writable Programs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_user_dot_no_world_writable_programs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_user_interactive_home_directory_defined_ocil:questionnaire:1">
          <ocil:title>All Interactive Users Must Have A Home Directory Defined</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_user_interactive_home_directory_defined_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsh_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall rsh Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsh_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_tmp_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ssh_keys_passphrase_protected_ocil:questionnaire:1">
          <ocil:title>Verify the SSH Private Key Files Have a Passcode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ssh_keys_passphrase_protected_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_not_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux is Not Disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_not_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_cron_installed_ocil:questionnaire:1">
          <ocil:title>Install the cron service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_cron_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_difok_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_seccomp_ocil:questionnaire:1">
          <ocil:title>Enable seccomp to safely compute untrusted bytecode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_seccomp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1">
          <ocil:title>Require Credential Prompting for Remote Access in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_user_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/user.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_user_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-root_permissions_syslibrary_files_ocil:questionnaire:1">
          <ocil:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are group-owned by root.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-root_permissions_syslibrary_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1">
          <ocil:title>Enable ExecShield via sysctl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_users_home_files_ownership_ocil:questionnaire:1">
          <ocil:title>All User Files and Directories In The Home Directory Must Have a Valid Owner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_users_home_files_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_lcredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_chronyd_enabled_ocil:questionnaire:1">
          <ocil:title>The Chronyd service is enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_chronyd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_firewalld_installed_ocil:questionnaire:1">
          <ocil:title>Install firewalld Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_firewalld_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_etc_sudoersd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/sudoers.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_etc_sudoersd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1">
          <ocil:title>Set GNOME3 Screensaver Inactivity Timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_config_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server config file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_config_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_root_password_configured_ocil:questionnaire:1">
          <ocil:title>Ensure Authentication Required for Single User Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_root_password_configured_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hid_and_hub_ocil:questionnaire:1">
          <ocil:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_tmp_ocil:questionnaire:1">
          <ocil:title>Ensure /tmp Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_sshd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the OpenSSH Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_sshd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_warning_banner_net_ocil:questionnaire:1">
          <ocil:title>Enable SSH Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_warning_banner_net_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_perm_change_success_ocil:questionnaire:1">
          <ocil:title>Configure auditing of successful permission changes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_perm_change_success_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Bluetooth Kernel Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1">
          <ocil:title>Install libselinux Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libselinux_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall net-snmp Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_net-snmp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_ftp_removed_ocil:questionnaire:1">
          <ocil:title>Remove ftp Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_ftp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_privileged_commands_poweroff_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - poweroff</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_privileged_commands_poweroff_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_dmesg_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict unprivileged access to the kernel syslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_dmesg_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_umount2_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - umount2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1">
          <ocil:title>Ensure All Files Are Owned by a Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_ungroupowned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_audit_configuration_ocil:questionnaire:1">
          <ocil:title>Audit Configuration Files Permissions are 640 or More Restrictive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_audit_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_audit_rulesd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/audit/rules.d/*.rules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_audit_rulesd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_dedicated_group_ocil:questionnaire:1">
          <ocil:title>Ensure a dedicated group owns sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_dedicated_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_srv_ocil:questionnaire:1">
          <ocil:title>Ensure /srv Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_srv_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_randomize_base_ocil:questionnaire:1">
          <ocil:title>Randomize the address of the kernel image (KASLR)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_randomize_base_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_notifiers_ocil:questionnaire:1">
          <ocil:title>Enable checks on notifier call chains</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_notifiers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1">
          <ocil:title>Set Interval For Counting Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_minclass_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Network Environment</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_user_locks_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_user_locks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_ocil:questionnaire:1">
          <ocil:title>Disable the authlogin_nsswitch_use_ldap SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_authlogin_nsswitch_use_ldap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1">
          <ocil:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_db_up_to_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1">
          <ocil:title>Verify All Account Password Hashes are Shadowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_all_shadowed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1">
          <ocil:title>Allow Only SSH Protocol 2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1">
          <ocil:title>Deactivate Wireless Network Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-wireless_disable_interfaces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_create_success_ocil:questionnaire:1">
          <ocil:title>Configure auditing of successful file creations</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_create_success_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1">
          <ocil:title>Install cryptsetup Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Reboot Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_opensc_installed_ocil:questionnaire:1">
          <ocil:title>Install the opensc Package For Multifactor Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_opensc_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_authorized_local_users_ocil:questionnaire:1">
          <ocil:title>Only Authorized Local User Accounts Exist on Operating System</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_authorized_local_users_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1">
          <ocil:title>Direct root Logins Not Allowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_direct_root_logins_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_gssapi_auth_ocil:questionnaire:1">
          <ocil:title>Enable GSSAPI Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_audit_configuration_ocil:questionnaire:1">
          <ocil:title>Audit Configuration Files Must Be Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_audit_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_set_warn_age_existing_ocil:questionnaire:1">
          <ocil:title>Set Existing Passwords Warning Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_set_warn_age_existing_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall nfs-utils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nfs-utils_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_system_commands_root_owned_ocil:questionnaire:1">
          <ocil:title>Verify that system commands directories have root ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_system_commands_root_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_cyrus-imapd_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall cyrus-imapd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_cyrus-imapd_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-encrypt_partitions_ocil:questionnaire:1">
          <ocil:title>Encrypt Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-encrypt_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_usrquota_ocil:questionnaire:1">
          <ocil:title>Add usrquota Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_usrquota_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_usermod_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - usermod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_usermod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_selinuxuser_execstack_ocil:questionnaire:1">
          <ocil:title>Disable the selinuxuser_execstack SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_selinuxuser_execstack_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux Not Disabled in /etc/default/grub</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_enable_selinux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1">
          <ocil:title>Record Access Events to Audit Log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_access_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_uvcvideo_disabled_ocil:questionnaire:1">
          <ocil:title>Disable the uvcvideo module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_uvcvideo_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1">
          <ocil:title>Assign Expiration Date to Temporary Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_temp_expire_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_suid_privilege_function_ocil:questionnaire:1">
          <ocil:title>Record Events When Privileged Executables Are Run</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_suid_privilege_function_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1">
          <ocil:title>Set Default ip6tables Policy for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_ip6tables_default_rule_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_passwords_pam_faillock_audit_ocil:questionnaire:1">
          <ocil:title>Account Lockouts Must Be Logged</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_passwords_pam_faillock_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_setsebool_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run setsebool</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_setsebool_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Files Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1">
          <ocil:title>Restrict Virtual Console Root Logins</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-securetty_root_login_console_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1">
          <ocil:title>Enable Randomized Layout of Virtual Address Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_set_max_life_existing_ocil:questionnaire:1">
          <ocil:title>Set Existing Passwords Maximum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_set_max_life_existing_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable X11 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1">
          <ocil:title>Enable Use of Privilege Separation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_priv_separation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_at_deny_not_exist_ocil:questionnaire:1">
          <ocil:title>Ensure that /etc/at.deny does not exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_at_deny_not_exist_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sudo_installed_ocil:questionnaire:1">
          <ocil:title>Install sudo Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sudo_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1">
          <ocil:title>Restrict usage of ptrace to descendant processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1">
          <ocil:title>Set SSH MaxSessions limit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_max_sessions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_crontab_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Crontab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_crontab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_shells_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/shells File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_shells_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_weekly_ocil:questionnaire:1">
          <ocil:title>Verify Owner on cron.weekly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_weekly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_randstruct_ocil:questionnaire:1">
          <ocil:title>Randomize layout of sensitive kernel structures</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_randstruct_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-server_removed_ocil:questionnaire:1">
          <ocil:title>Remove the OpenSSH Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_firewire-core_disabled_ocil:questionnaire:1">
          <ocil:title>Disable IEEE 1394 (FireWire) Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rlogin_disabled_ocil:questionnaire:1">
          <ocil:title>Disable rlogin Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rlogin_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_proc_kcore_ocil:questionnaire:1">
          <ocil:title>Disable support for /proc/kkcore</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_proc_kcore_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_modify_success_ocil:questionnaire:1">
          <ocil:title>Configure auditing of successful file modifications</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_modify_success_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_dracut_fips_module_ocil:questionnaire:1">
          <ocil:title>Enable Dracut FIPS Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_dracut_fips_module_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_sudoers_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/sudoers File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_sudoers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly in /etc/profile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_profile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1">
          <ocil:title>Enable Encrypted X11 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_prevent_unrestricted_relay_ocil:questionnaire:1">
          <ocil:title>Prevent Unrestricted Mail Relaying</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_prevent_unrestricted_relay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audit_installed_ocil:questionnaire:1">
          <ocil:title>Ensure the audit Subsystem is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audit_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_min_rounds_logindefs_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Rounds in /etc/login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_min_rounds_logindefs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-firewalld_loopback_traffic_trusted_ocil:questionnaire:1">
          <ocil:title>Configure Firewalld to Trust Loopback Traffic</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-firewalld_loopback_traffic_trusted_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_monthly_ocil:questionnaire:1">
          <ocil:title>Verify Owner on cron.monthly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_monthly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_ocil:questionnaire:1">
          <ocil:title>Configure Denying Router Solicitations on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_hardened_usercopy_fallback_ocil:questionnaire:1">
          <ocil:title>Do not allow usercopy whitelist violations to fallback to object size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_hardened_usercopy_fallback_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_semanage_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run semanage</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_semanage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_custom_logfile_ocil:questionnaire:1">
          <ocil:title>Ensure Sudo Logfile Exists - sudo logfile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_custom_logfile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1">
          <ocil:title>Disable Core Dumps for All Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_users_coredumps_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_core_uses_pid_ocil:questionnaire:1">
          <ocil:title>Configure file name of core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_core_uses_pid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_ocil:questionnaire:1">
          <ocil:title>Generate some entropy during boot and runtime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_latent_entropy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_kerberos_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the kerberos_enabled SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_kerberos_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-xwindows_remove_packages_ocil:questionnaire:1">
          <ocil:title>Disable graphical user interface</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-xwindows_remove_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_seunshare_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run seunshare</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_seunshare_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_validate_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure invoking users password for privilege escalation when using sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_validate_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_list_ocil:questionnaire:1">
          <ocil:title>Enable checks on linked list manipulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_list_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_chrony_keys_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/chrony.keys File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_chrony_keys_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_panic_on_oops_ocil:questionnaire:1">
          <ocil:title>Kernel panic oops</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_panic_on_oops_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_modules_disabled_ocil:questionnaire:1">
          <ocil:title>Disable loading and unloading of kernel modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_modules_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_log_ocil:questionnaire:1">
          <ocil:title>Ensure /var/log Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_no_chronyc_network_ocil:questionnaire:1">
          <ocil:title>Disable network management of chrony daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_no_chronyc_network_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gnutls-utils_installed_ocil:questionnaire:1">
          <ocil:title>Ensure gnutls-utils is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gnutls-utils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1">
          <ocil:title>Disable debug-shell SystemD Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_debug-shell_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_randomize_memory_ocil:questionnaire:1">
          <ocil:title>Randomize the kernel memory sections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_randomize_memory_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable the IPv6 protocol</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_umount_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - umount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1">
          <ocil:title>Enable syslog-ng Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_syslogng_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_selinuxuser_execheap_ocil:questionnaire:1">
          <ocil:title>Disable the selinuxuser_execheap SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_selinuxuser_execheap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure Libreswan to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_selinuxuser_execmod_ocil:questionnaire:1">
          <ocil:title>Enable the selinuxuser_execmod SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_selinuxuser_execmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Mounting of cramfs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_chsh_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_groupowner_etc_iptables_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/iptables Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_groupowner_etc_iptables_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1">
          <ocil:title>Install the pcsc-lite package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_pcsc-lite_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1">
          <ocil:title>Ensure No Device Files are Unlabeled by SELinux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_ocil:questionnaire:1">
          <ocil:title>zero-init everything passed by reference</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-display_login_attempts_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Displays Last Logon/Access Notification</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-display_login_attempts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_configure_name_resolution_ocil:questionnaire:1">
          <ocil:title>Configure Multiple DNS Servers in /etc/resolv.conf</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_configure_name_resolution_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_mds_argument_ocil:questionnaire:1">
          <ocil:title>Configure Microarchitectural Data Sampling mitigation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_mds_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_aide_installed_ocil:questionnaire:1">
          <ocil:title>Install AIDE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_aide_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rear_installed_ocil:questionnaire:1">
          <ocil:title>Install rear Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rear_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1">
          <ocil:title>Set Default firewalld Zone for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_firewalld_default_zone_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1">
          <ocil:title>Verify Only Root Has UID 0</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_no_uid_except_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executables Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1">
          <ocil:title>Ensure syslog-ng is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_syslogng_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_user_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/user.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_user_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_user_max_user_namespaces_ocil:questionnaire:1">
          <ocil:title>Disable the use of user namespaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dnf-automatic_apply_updates_ocil:questionnaire:1">
          <ocil:title>Configure dnf-automatic to Install Available Updates Automatically</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dnf-automatic_apply_updates_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1">
          <ocil:title>Configure auditd mail_acct Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-agent_mfetpd_running_ocil:questionnaire:1">
          <ocil:title>Ensure McAfee Endpoint Security for Linux (ENSL) is running</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-agent_mfetpd_running_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_ptys_ocil:questionnaire:1">
          <ocil:title>Disable legacy (BSD) PTY support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_ptys_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nosuid_removable_partitions_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to Removable Media Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nosuid_removable_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Exporting to Media (successful)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_media_export_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_hourly_ocil:questionnaire:1">
          <ocil:title>Verify Owner on cron.hourly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_hourly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_efi_user_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/user.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_efi_user_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_ocil:questionnaire:1">
          <ocil:title>Configure Sending and Accepting Shared Media Redirects by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_state_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux State is Enforcing</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_state_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse: system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_usbguard_auditbackend_ocil:questionnaire:1">
          <ocil:title>Log USBGuard daemon audit events using Linux Audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_usbguard_auditbackend_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_cron_monthly_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on cron.monthly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_cron_monthly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_compat_vdso_ocil:questionnaire:1">
          <ocil:title>Disable the 32-bit vDSO</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_compat_vdso_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-firewalld-backend_ocil:questionnaire:1">
          <ocil:title>Configure Firewalld to Use the Nftables Backend</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-firewalld-backend_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_issue_net_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership of System Login Banner for Remote Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_issue_net_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-systemd_tmp_mount_enabled_ocil:questionnaire:1">
          <ocil:title>Ensure tmp.mount Unit Is Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-systemd_tmp_mount_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_efi_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /boot/efi</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_efi_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_groupowner_etc_selinux_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/selinux Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_groupowner_etc_selinux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_policytype_ocil:questionnaire:1">
          <ocil:title>Configure SELinux Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_policytype_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_vsyscall_none_ocil:questionnaire:1">
          <ocil:title>Disable vsyscall mapping</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_vsyscall_none_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_nftables_disabled_ocil:questionnaire:1">
          <ocil:title>Verify nftables Service is Disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_nftables_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_immutable_login_uids_ocil:questionnaire:1">
          <ocil:title>Configure immutable Audit login UIDs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_immutable_login_uids_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1">
          <ocil:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gid_passwd_group_same_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1">
          <ocil:title>Ensure Logrotate Runs Periodically</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_logrotate_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_setroubleshoot-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall setroubleshoot-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1">
          <ocil:title>Set Account Expiration Following Inactivity</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_disable_post_pw_expiration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_audit_tools_permissions_ocil:questionnaire:1">
          <ocil:title>Audit Tools Must Have a Mode of 0755 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_audit_tools_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_ipsec_conf_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/ipsec.conf File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_ipsec_conf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_sudo_log_events_ocil:questionnaire:1">
          <ocil:title>Record Attempts to perform maintenance activities</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_sudo_log_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_writable_hooks_ocil:questionnaire:1">
          <ocil:title>Disable mutable hooks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_writable_hooks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-use_pam_wheel_for_su_ocil:questionnaire:1">
          <ocil:title>Enforce usage of pam_wheel for su authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-use_pam_wheel_for_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_kdump_disabled_ocil:questionnaire:1">
          <ocil:title>Disable KDump Kernel Crash Analyzer (kdump)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_kdump_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_autorun_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automount running</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_autorun_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1">
          <ocil:title>Ensure Logs Sent To Remote Host</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_loghost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1">
          <ocil:title>Ensure All SUID Executables Are Authorized</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_syslog_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log/syslog File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_syslog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_empty_passwords_ocil:questionnaire:1">
          <ocil:title>Prevent Login to Accounts With Empty Password</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_empty_passwords_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_privileged_commands_reboot_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - reboot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_privileged_commands_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_syslog_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log/syslog File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_syslog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permission_user_init_files_ocil:questionnaire:1">
          <ocil:title>Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permission_user_init_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Time Through clock_settime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_clock_settime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_slab_nomerge_argument_ocil:questionnaire:1">
          <ocil:title>Disable merging of slabs with similar size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_slab_nomerge_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Client to Use FIPS 140 Validated Ciphers: openssh.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_password_ocil:questionnaire:1">
          <ocil:title>Set Boot Loader Password in grub2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_syslog_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log/syslog File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_syslog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_allow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/cron.allow file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_allow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dnf-automatic_security_updates_only_ocil:questionnaire:1">
          <ocil:title>Configure dnf-automatic to Install Only Security Updates</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dnf-automatic_security_updates_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_core_bpf_jit_harden_ocil:questionnaire:1">
          <ocil:title>Harden the operation of the BPF just-in-time compiler</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Interval</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_idle_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1">
          <ocil:title>Ensure System Log Files Have Correct Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_csh_cshrc_ocil:questionnaire:1">
          <ocil:title>Ensure the Default C Shell Umask is Set Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1">
          <ocil:title>Disable kernel support for MISC binaries</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_polyinstantiated_tmp_ocil:questionnaire:1">
          <ocil:title>Configure Polyinstantiation of /tmp Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_ipsec_secrets_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/ipsec.secrets File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_ipsec_secrets_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_system_shutdown_ocil:questionnaire:1">
          <ocil:title>Shutdown System When Auditing Failures Occur</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_system_shutdown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_strict_kernel_rwx_ocil:questionnaire:1">
          <ocil:title>Make the kernel text and rodata read-only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_strict_kernel_rwx_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1">
          <ocil:title>Avoid speculative indirect branches in kernel</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_passwordauth_ocil:questionnaire:1">
          <ocil:title>Set PAM''s Password Hashing Algorithm - password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_passwordauth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Files Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1">
          <ocil:title>Enable Smartcards in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_smartcards_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ufw_enabled_ocil:questionnaire:1">
          <ocil:title>Verify ufw Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ufw_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Have Mode 0640 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_tmp_ocil:questionnaire:1">
          <ocil:title>Ensure /var/tmp Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-firewalld_sshd_port_enabled_ocil:questionnaire:1">
          <ocil:title>Enable SSH Server firewalld Firewall Exception</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-firewalld_sshd_port_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1">
          <ocil:title>Ensure No World-Writable Files Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_ocil:questionnaire:1">
          <ocil:title>Configure Response Mode of ARP Requests for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_log_format_ocil:questionnaire:1">
          <ocil:title>Resolve information before writing to audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_log_format_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1">
          <ocil:title>Set GNOME3 Screensaver Lock Delay After Activation Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict Access to Kernel Message Buffer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1">
          <ocil:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1">
          <ocil:title>Ensure /var/log/audit Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for Local Packages</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_usbguard_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the USBGuard Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_usbguard_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_mac_modification_usr_share_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Mandatory Access Controls in usr/share</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_mac_modification_usr_share_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to Expire Offline Credentials</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_offline_cred_expiration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_ocil:questionnaire:1">
          <ocil:title>Set number of Password Hashing Rounds - system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_rounds_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_credentials_ocil:questionnaire:1">
          <ocil:title>Enable checks on credential management</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_credentials_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_ownership_ocil:questionnaire:1">
          <ocil:title>Verify and Correct Ownership with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_snmpd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable snmpd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_snmpd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1">
          <ocil:title>Verify File Hashes with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_hashes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_sshd_config_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns SSH Server config file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_sshd_config_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_crypto-policies_installed_ocil:questionnaire:1">
          <ocil:title>Install crypto-policies package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_crypto-policies_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_nosmep_argument_absent_ocil:questionnaire:1">
          <ocil:title>Ensure SMEP is not disabled during boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1">
          <ocil:title>Install audispd-plugins Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audispd-plugins_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_slub_debug_argument_ocil:questionnaire:1">
          <ocil:title>Enable SLUB/SLAB allocator poisoning</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_slub_debug_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_vmap_stack_ocil:questionnaire:1">
          <ocil:title>User a virtually-mapped stack</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_vmap_stack_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Harden SSH client Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1">
          <ocil:title>Ensure All-Squashing Disabled On All Exports</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_all_squash_exports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_password_pam_faillock_system_auth_ocil:questionnaire:1">
          <ocil:title>Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_password_pam_faillock_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1">
          <ocil:title>Disable GSSAPI Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_syn_cookies_ocil:questionnaire:1">
          <ocil:title>Enable TCP/IP syncookie support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_syn_cookies_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_name_format_ocil:questionnaire:1">
          <ocil:title>Set type of computer node name logging in audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_name_format_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_telnet_disabled_ocil:questionnaire:1">
          <ocil:title>Disable telnet Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_telnet_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_etc_selinux_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/selinux Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_etc_selinux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_event_paranoid_ocil:questionnaire:1">
          <ocil:title>Disallow kernel profiling by unprivileged users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1">
          <ocil:title>Enable SSH Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_warning_banner_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_audit_tools_ownership_ocil:questionnaire:1">
          <ocil:title>Audit Tools Must Be Owned by Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_audit_tools_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-logind_session_timeout_ocil:questionnaire:1">
          <ocil:title>Configure Logind to terminate idle sessions after certain time of inactivity</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-logind_session_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Error Action on Disk Error</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_error_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_ocil:questionnaire:1">
          <ocil:title>Enable the GNOME3 Screen Locking On Smartcard Removal</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Mandatory Access Controls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_mac_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_ipsec_secrets_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/ipsec.secrets File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_ipsec_secrets_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1">
          <ocil:title>Disable SSH Root Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_root_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_sshd_pub_key_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership on SSH Server Public *.pub Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_sshd_pub_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_access_failed_ocil:questionnaire:1">
          <ocil:title>Configure auditing of unsuccessful file accesses</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_access_failed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_telnet_removed_ocil:questionnaire:1">
          <ocil:title>Remove telnet Clients</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_telnet_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1">
          <ocil:title>Set SSH Daemon LogLevel to VERBOSE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_ocil:questionnaire:1">
          <ocil:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_strict_module_rwx_ocil:questionnaire:1">
          <ocil:title>Make the module text and rodata read-only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_strict_module_rwx_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_set_max_life_root_ocil:questionnaire:1">
          <ocil:title>Set Root Account Password Maximum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_set_max_life_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable SSH TCP Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_sshd_private_key_ocil:questionnaire:1">
          <ocil:title>Verify Ownership on SSH Server Private *_key Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_sshd_private_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_has_trust_anchor_ocil:questionnaire:1">
          <ocil:title>SSSD Has a Correct Trust Anchor</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_has_trust_anchor_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1">
          <ocil:title>Set Password Maximum Consecutive Repeating Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1">
          <ocil:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_use_pty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_secure_mode_insmod_ocil:questionnaire:1">
          <ocil:title>Configure the secure_mode_insmod SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_secure_mode_insmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_module_load_ocil:questionnaire:1">
          <ocil:title>Configure auditing of loading and unloading of kernel modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_module_load_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server Private *_key Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_private_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail For The Root Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_d_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns cron.d</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_d_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1">
          <ocil:title>Use Centralized and Automated Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_use_centralized_automated_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_cron_allow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/cron.allow file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_cron_allow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_no_root_target_ocil:questionnaire:1">
          <ocil:title>Don't target root user in the sudoers file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_no_root_target_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_full_action_stig_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Full Action when Disk Space Is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_full_action_stig_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1">
          <ocil:title>Install policycoreutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_policycoreutils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-prefer_64bit_os_ocil:questionnaire:1">
          <ocil:title>Prefer to use a 64-bit Operating System when supported</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-prefer_64bit_os_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_scan_notification_ocil:questionnaire:1">
          <ocil:title>Configure Notification of Post-AIDE Scan Details</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_scan_notification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_issue_net_ocil:questionnaire:1">
          <ocil:title>Modify the System Login Banner for Remote Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_issue_net_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail From Postmaster to The Root Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_chrony_installed_ocil:questionnaire:1">
          <ocil:title>The Chrony package is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_chrony_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_pid_max_ocil:questionnaire:1">
          <ocil:title>Configure maximum number of process identifiers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_pid_max_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_stackleak_ocil:questionnaire:1">
          <ocil:title>Poison kernel stack before returning from syscalls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_stackleak_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_fips_mode_ocil:questionnaire:1">
          <ocil:title>Enable FIPS Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_fips_mode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_empty_passwords_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Ensure There Are No Accounts With Blank or Null Passwords</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_empty_passwords_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1">
          <ocil:title>Ensure All Files Are Owned by a User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_files_unowned_by_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1">
          <ocil:title>Install usbguard Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_usbguard_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_noexec_ocil:questionnaire:1">
          <ocil:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_postqueue_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - postqueue</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_postqueue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1">
          <ocil:title>Install scap-security-guide Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_scap-security-guide_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_core_pattern_empty_string_ocil:questionnaire:1">
          <ocil:title>Disable storing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_core_pattern_empty_string_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_ocil:questionnaire:1">
          <ocil:title>Limit CPU consumption of the Perf system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_admin_username_ocil:questionnaire:1">
          <ocil:title>Set the Boot Loader Admin Username to a Non-Default Value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_admin_username_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_delete_failed_ocil:questionnaire:1">
          <ocil:title>Configure auditing of unsuccessful file deletions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_delete_failed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwquality_password_auth_ocil:questionnaire:1">
          <ocil:title>Ensure PAM password complexity module is enabled in password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwquality_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_explicit_command_args_ocil:questionnaire:1">
          <ocil:title>Explicit arguments in sudo specifications</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_explicit_command_args_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_avahi-daemon_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Avahi Server Software</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_avahi-daemon_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_pam_wheel_group_empty_ocil:questionnaire:1">
          <ocil:title>Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_pam_wheel_group_empty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_core_pattern_ocil:questionnaire:1">
          <ocil:title>Disable storing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_x11_use_localhost_ocil:questionnaire:1">
          <ocil:title>Prevent remote hosts from connecting to the proxy display</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_x11_use_localhost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_panic_timeout_ocil:questionnaire:1">
          <ocil:title>Kernel panic timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_panic_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_ocil:questionnaire:1">
          <ocil:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_chrony_keys_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/chrony.keys File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_chrony_keys_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the pcscd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_pcscd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_poisoning_ocil:questionnaire:1">
          <ocil:title>Enable poison of pages after freeing</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_poisoning_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1">
          <ocil:title>Set PAM''s Password Hashing Algorithm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1">
          <ocil:title>Configure Backups of User Data</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_user_data_backups_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1">
          <ocil:title>Only the VDSM User Can Use sudo NOPASSWD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog-gnutls is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1">
          <ocil:title>Configure auditd to use audispd's syslog plugin</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_systemmap_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns System.map Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_systemmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_tmp_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_tmp_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_squid_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Squid</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_squid_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_crontab_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on crontab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_crontab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_remove_no_authenticate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_group_ownership_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Be Group Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_group_ownership_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_restrict_privilege_elevation_to_authorized_ocil:questionnaire:1">
          <ocil:title>The operating system must restrict privilege elevation to authorized personnel</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_restrict_privilege_elevation_to_authorized_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_privileged_commands_init_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - init</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_privileged_commands_init_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure BIND to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_bind_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_ocil:questionnaire:1">
          <ocil:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_regular_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Regular files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_regular_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable auditd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_auditd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure rsyncd service is disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rsyncd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_owner_etc_ipsecd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/ipsec.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_owner_etc_ipsecd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_kexec_ocil:questionnaire:1">
          <ocil:title>Disable kexec system call</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_kexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - rmdir</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1">
          <ocil:title>Record attempts to alter time through adjtimex</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_adjtimex_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for User Known Hosts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1">
          <ocil:title>Ensure that chronyd is running under chrony user account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_run_as_chrony_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1">
          <ocil:title>Enable PAM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_network_listening_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Postfix Network Listening</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_network_listening_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_sestatus_conf_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/sestatus.conf File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_sestatus_conf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_error_action_stig_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Error Action on Disk Error</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_ocil:questionnaire:1">
          <ocil:title>Configure Time Service Maxpoll Interval</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_ssh_sysadm_login_ocil:questionnaire:1">
          <ocil:title>Disable the ssh_sysadm_login SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_ssh_sysadm_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_systemmap_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns System.map Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_systemmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_noexec_remote_filesystems_ocil:questionnaire:1">
          <ocil:title>Mount Remote Filesystems with noexec</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_noexec_remote_filesystems_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1">
          <ocil:title>Ensure SSH MaxStartups is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_maxstartups_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_configure_pool_and_server_ocil:questionnaire:1">
          <ocil:title>Chrony Configure Pool and Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_configure_pool_and_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_groupowner_etc_nftables_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/nftables Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_groupowner_etc_nftables_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_daily_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns cron.daily</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_daily_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_unix_update_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_update</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_unix_update_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_percentage_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_percentage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Modprobe Loading of USB Storage Driver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1">
          <ocil:title>Set number of Password Hashing Rounds - password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_rounds_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_modify_failed_ocil:questionnaire:1">
          <ocil:title>Configure auditing of unsuccessful file modifications</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_modify_failed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_acpi_custom_method_ocil:questionnaire:1">
          <ocil:title>Do not allow ACPI methods to be inserted/replaced at run time</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_acpi_custom_method_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_root_password_login_ocil:questionnaire:1">
          <ocil:title>Disable SSH root Login with a Password (Insecure)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_root_password_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_interactive_users_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly For Interactive Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_interactive_users_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sssd_installed_ocil:questionnaire:1">
          <ocil:title>Install the SSSD Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sssd_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-timer_dnf-automatic_enabled_ocil:questionnaire:1">
          <ocil:title>Enable dnf-automatic Timer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-timer_dnf-automatic_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_crypttab_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/crypttab File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_crypttab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_owner_change_failed_ocil:questionnaire:1">
          <ocil:title>Configure auditing of unsuccessful ownership changes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_owner_change_failed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_user_interactive_home_directory_exists_ocil:questionnaire:1">
          <ocil:title>All Interactive Users Home Directories Must Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_user_interactive_home_directory_exists_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_generate_policy_ocil:questionnaire:1">
          <ocil:title>Generate USBGuard Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_generate_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_ocil:questionnaire:1">
          <ocil:title>Enable module signature verification</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1">
          <ocil:title>Disable Compression Or Set Compression to delayed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_compression_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1">
          <ocil:title>Ensure No Daemons are Unconfined by SELinux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_confinement_of_daemons_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_root_owned_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Owned by root User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Time Through stime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_stime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run chcon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_chcon_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_systemd-coredump_disabled_ocil:questionnaire:1">
          <ocil:title>Disable acquiring, saving, and processing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_systemd-coredump_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1">
          <ocil:title>Ensure Log Files Are Owned By Appropriate Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_groupownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_etc_iptables_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/iptables Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_etc_iptables_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1">
          <ocil:title>Configure auditd flush priority</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_flush_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_sg_ocil:questionnaire:1">
          <ocil:title>Enable checks on scatter-gather (SG) table operations</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_sg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_wx_ocil:questionnaire:1">
          <ocil:title>Warn on W+X mappings found at boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_wx_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1">
          <ocil:title>Do Not Allow SSH Environment Options</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_access_success_ocil:questionnaire:1">
          <ocil:title>Configure auditing of successful file accesses</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_access_success_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-group_unique_id_ocil:questionnaire:1">
          <ocil:title>Ensure All Groups on the System Have Unique Group ID</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-group_unique_id_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_s-nail_installed_ocil:questionnaire:1">
          <ocil:title>The s-nail Package Is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_s-nail_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_issue_net_ocil:questionnaire:1">
          <ocil:title>Verify ownership of System Login Banner for Remote Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_net_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_ipsec_secrets_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/ipsec.secrets File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_ipsec_secrets_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_fifos_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on FIFOs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_fifos_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_ocil:questionnaire:1">
          <ocil:title>Ensure /var Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_ipsec_conf_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/ipsec.conf File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_ipsec_conf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_remove_nopasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_tmp_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_tmp_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Algorithm in /etc/login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable the Automounter</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_autofs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_issue_net_ocil:questionnaire:1">
          <ocil:title>Verify permissions on System Login Banner for Remote Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_issue_net_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-xwindows_runlevel_target_ocil:questionnaire:1">
          <ocil:title>Disable Graphical Environment Startup By Setting Default Target</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-xwindows_runlevel_target_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_ctrlaltdel_burstaction_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Burst Action</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_ctrlaltdel_burstaction_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1">
          <ocil:title>Remove the X Windows Package Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - openat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_sudoers_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/sudoers File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_sudoers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-security_patches_up_to_date_ocil:questionnaire:1">
          <ocil:title>Ensure Software Patches Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-security_patches_up_to_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_ospp_general_ocil:questionnaire:1">
          <ocil:title>Perform general configuration of Audit for OSPP</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_ospp_general_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_crond_enabled_ocil:questionnaire:1">
          <ocil:title>Enable cron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_crond_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_cron_d_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on cron.d</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_cron_d_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsyslog_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1">
          <ocil:title>Record attempts to alter time through settimeofday</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_settimeofday_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_hash_ocil:questionnaire:1">
          <ocil:title>Specify the hash to use when signing modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_hash_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_ocil:questionnaire:1">
          <ocil:title>Disable Accepting Packets Routed Between Local Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1">
          <ocil:title>Require Authentication for Single User Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-require_singleuser_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Login Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_uefi_password_ocil:questionnaire:1">
          <ocil:title>Set the UEFI Boot Loader Password</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_uefi_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_tls_ocil:questionnaire:1">
          <ocil:title>Configure TLS for rsyslog remote logging</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_tls_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_cron_weekly_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on cron.weekly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_cron_weekly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_fapolicyd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the File Access Policy Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_fapolicyd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsh-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall rsh-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsh-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_compat_brk_ocil:questionnaire:1">
          <ocil:title>Disable compatibility with brk()</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_compat_brk_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slab_freelist_random_ocil:questionnaire:1">
          <ocil:title>Randomize slab freelist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slab_freelist_random_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall Sendmail Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sendmail_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Full Action when Disk Space Is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_full_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_require_reauthentication_ocil:questionnaire:1">
          <ocil:title>Require Re-Authentication When Using the sudo Command</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_require_reauthentication_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1">
          <ocil:title>Require Encryption for Remote Access in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_at_allow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/at.allow file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_at_allow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1">
          <ocil:title>Disable SSH Access via Empty Passwords</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_empty_passwords_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_require_authentication_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_certmap_ocil:questionnaire:1">
          <ocil:title>Enable Certmap in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_certmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_hibernation_ocil:questionnaire:1">
          <ocil:title>Disable hibernation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_hibernation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1">
          <ocil:title>Disable the GNOME3 Login Restart and Shutdown Buttons</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1">
          <ocil:title>Configure L1 Terminal Fault mitigations</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_l1tf_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1">
          <ocil:title>Limit Users' SSH Access</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_limit_user_access_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1">
          <ocil:title>Ensure All SGID Executables Are Authorized</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_page_alloc_shuffle_argument_ocil:questionnaire:1">
          <ocil:title>Enable randomization of the page allocator</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_page_alloc_shuffle_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1">
          <ocil:title>Configure GNOME3 DConf User Profile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_dconf_user_profile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Screensaver Idle Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_authselect_ocil:questionnaire:1">
          <ocil:title>Enable authselect</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_authselect_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1">
          <ocil:title>Disable x86 vsyscall emulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure System is Not Acting as a Network Sniffer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_sniffer_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_cron_deny_not_exist_ocil:questionnaire:1">
          <ocil:title>Ensure that /etc/cron.deny does not exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_cron_deny_not_exist_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nftables_installed_ocil:questionnaire:1">
          <ocil:title>Install nftables Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nftables_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_hourly_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns cron.hourly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_hourly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_oddjobd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Odd Job Daemon (oddjobd)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_oddjobd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_last_change_is_in_past_ocil:questionnaire:1">
          <ocil:title>Ensure all users last password change date is in the past</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_last_change_is_in_past_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tftp-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall tftp-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tftp-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_action_stig_ocil:questionnaire:1">
          <ocil:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action_stig_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_group_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Root Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_group_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_check_audit_tools_ocil:questionnaire:1">
          <ocil:title>Configure AIDE to Verify the Audit Tools</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_check_audit_tools_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configured_firewalld_default_deny_ocil:questionnaire:1">
          <ocil:title>Firewalld Must Employ a Deny-all, Allow-by-exception Policy for Allowing Connections to Other Systems</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configured_firewalld_default_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_audit_tools_group_ownership_ocil:questionnaire:1">
          <ocil:title>Audit Tools Must Be Group-owned by Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_audit_tools_group_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_shells_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/shells File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_shells_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server Public *.pub Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_login_grace_time_ocil:questionnaire:1">
          <ocil:title>Ensure SSH LoginGraceTime is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_login_grace_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1">
          <ocil:title>Ensure Log Files Are Owned By Appropriate User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_postfix_enabled_ocil:questionnaire:1">
          <ocil:title>Enable Postfix Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_postfix_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - faillock</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_faillock_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1">
          <ocil:title>The Installed Operating System Is Vendor Supported</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1">
          <ocil:title>Ensure that User Home Directories are not Group-Writable or World-Readable</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_home_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_etc_sysctld_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/sysctl.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_etc_sysctld_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_sshd_config_ocil:questionnaire:1">
          <ocil:title>Verify Owner on SSH Server config file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_sshd_config_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_privileged_commands_shutdown_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - shutdown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_privileged_commands_shutdown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1">
          <ocil:title>Verify firewalld Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_firewalld_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_chacl_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run chacl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_chacl_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_quagga_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall quagga Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_quagga_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_client_only_ocil:questionnaire:1">
          <ocil:title>Disable chrony daemon from acting as server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_client_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ssh_agent_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run ssh-agent</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_certificate_verification_ocil:questionnaire:1">
          <ocil:title>Certificate status checking in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_certificate_verification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_sestatus_conf_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/sestatus.conf File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_sestatus_conf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_talk_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall talk Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_talk_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_fortify_source_ocil:questionnaire:1">
          <ocil:title>Harden common str/mem functions against buffer overflows</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_fortify_source_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slab_merge_default_ocil:questionnaire:1">
          <ocil:title>Disallow merge of slab caches</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slab_merge_default_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1">
          <ocil:title>Force frequent session key renegotiation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_rekey_limit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_cron_hourly_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on cron.hourly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_cron_hourly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_password_pam_faillock_password_auth_ocil:questionnaire:1">
          <ocil:title>Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_password_pam_faillock_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_freq_ocil:questionnaire:1">
          <ocil:title>Set number of records to cause an explicit flush to audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_freq_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_all_ocil:questionnaire:1">
          <ocil:title>Enable automatic signing of all modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_all_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-clients_installed_ocil:questionnaire:1">
          <ocil:title>Install OpenSSH client software</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-clients_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1">
          <ocil:title>Unmap kernel when running in userspace (aka KAISER)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_ldap_configure_tls_reqcert_ocil:questionnaire:1">
          <ocil:title>Configure SSSD LDAP Backend Client to Demand a Valid Certificate from the Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_ldap_configure_tls_reqcert_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_dictcheck_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_dictcheck_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_efi_user_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/user.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_efi_user_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_sched_stack_end_check_ocil:questionnaire:1">
          <ocil:title>Detect stack corruption on calls to schedule()</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_sched_stack_end_check_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_logrotate_installed_ocil:questionnaire:1">
          <ocil:title>Ensure logrotate is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_logrotate_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_poisoning_no_sanity_ocil:questionnaire:1">
          <ocil:title>Enable poison without sanity check</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_poisoning_no_sanity_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_session_idle_user_locks_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_session_idle_user_locks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-firewalld_loopback_traffic_restricted_ocil:questionnaire:1">
          <ocil:title>Configure Firewalld to Restrict Loopback Traffic</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-firewalld_loopback_traffic_restricted_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_polyinstantiation_enabled_ocil:questionnaire:1">
          <ocil:title>Configure the polyinstantiation_enabled SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_polyinstantiation_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_key_ocil:questionnaire:1">
          <ocil:title>Specify module signing key to use</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_build_database_ocil:questionnaire:1">
          <ocil:title>Build and Test AIDE Database</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_build_database_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_groupowner_etc_sudoersd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/sudoers.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_groupowner_etc_sudoersd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall vsftpd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_vsftpd_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_disable_inactivity_system_auth_ocil:questionnaire:1">
          <ocil:title>Set Account Expiration Following Inactivity in system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_disable_inactivity_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_disable_inactivity_password_auth_ocil:questionnaire:1">
          <ocil:title>Set Account Expiration Following Inactivity in password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_disable_inactivity_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_crypto_fips_enabled_ocil:questionnaire:1">
          <ocil:title>Set kernel parameter 'crypto.fips_enabled' to 1</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_crontab_ocil:questionnaire:1">
          <ocil:title>Verify Owner on crontab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_crontab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_permissions_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executable Directories Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_permissions_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Length</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_minlen_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_groupowner_etc_ipsecd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/ipsec.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_groupowner_etc_ipsecd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_allow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/cron.allow file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_allow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1">
          <ocil:title>Configure the root Account for Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - creat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_hardened_usercopy_ocil:questionnaire:1">
          <ocil:title>Harden memory copies between kernel and userspace</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_hardened_usercopy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_automount_open_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automount Opening</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_automount_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_pubkey_auth_ocil:questionnaire:1">
          <ocil:title>Disable PubkeyAuthentication Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd admin_space_left Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-use_pam_wheel_group_for_su_ocil:questionnaire:1">
          <ocil:title>Enforce Usage of pam_wheel with Group Parameter for su Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-use_pam_wheel_group_for_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_passwords_pam_faillock_dir_ocil:questionnaire:1">
          <ocil:title>Account Lockouts Must Persist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_passwords_pam_faillock_dir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_dir_ocil:questionnaire:1">
          <ocil:title>Lock Accounts Must Persist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_dir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_init_on_alloc_argument_ocil:questionnaire:1">
          <ocil:title>Configure kernel to zero out memory before allocation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_init_on_alloc_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_strong_macs_ocil:questionnaire:1">
          <ocil:title>Use Only Strong MACs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_strong_macs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1">
          <ocil:title>Extend Audit Backlog Limit for the Audit Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_audit_backlog_limit_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_postfix_installed_ocil:questionnaire:1">
          <ocil:title>The Postfix package is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_postfix_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_bug_on_data_corruption_ocil:questionnaire:1">
          <ocil:title>Trigger a kernel BUG when data corruption is detected</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_bug_on_data_corruption_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_deny_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns cron.deny</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_sysrq_ocil:questionnaire:1">
          <ocil:title>Disallow magic SysRq key</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_sysrq_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_systemd-journald_enabled_ocil:questionnaire:1">
          <ocil:title>Enable systemd-journald Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_systemd-journald_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_ocredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_user_home_paths_only_ocil:questionnaire:1">
          <ocil:title>Ensure that Users Path Contains Only Local Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_user_home_paths_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Have Mode 0750 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_default_mmap_min_addr_ocil:questionnaire:1">
          <ocil:title>Configure Low Address Space To Protect From User Allocation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_default_mmap_min_addr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automounting</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_automount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - open</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_host_auth_ocil:questionnaire:1">
          <ocil:title>Disable Host-Based Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_host_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Be Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_write_logs_ocil:questionnaire:1">
          <ocil:title>Write Audit Logs to the Disk</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_write_logs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_ocil:questionnaire:1">
          <ocil:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1">
          <ocil:title>Configure ARP filtering for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_module_sig_force_ocil:questionnaire:1">
          <ocil:title>Require modules to be validly signed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_module_sig_force_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executables Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_legacy_vsyscall_emulate_ocil:questionnaire:1">
          <ocil:title>Disable vsyscall emulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_legacy_vsyscall_emulate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_create_failed_ocil:questionnaire:1">
          <ocil:title>Configure auditing of unsuccessful file creations</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_create_failed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_efi_user_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/user.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_efi_user_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_oracle_gpgkey_installed_ocil:questionnaire:1">
          <ocil:title>Ensure Oracle Linux GPG Key Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_oracle_gpgkey_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_local_events_ocil:questionnaire:1">
          <ocil:title>Include Local Events in Audit Logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_local_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_stackprotector_ocil:questionnaire:1">
          <ocil:title>Stack Protector buffer overlow detection</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_stackprotector_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_grpquota_ocil:questionnaire:1">
          <ocil:title>Add grpquota Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_grpquota_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse: password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1">
          <ocil:title>Install the OpenSSH Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-server_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_postdrop_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - postdrop</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_postdrop_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_sudoers_d_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_sudoers_d_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for IPv6 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter the localtime File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_fapolicyd_installed_ocil:questionnaire:1">
          <ocil:title>Install fapolicyd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_fapolicyd_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1">
          <ocil:title>Set the GNOME3 Login Warning Banner Text</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_spectre_v2_argument_ocil:questionnaire:1">
          <ocil:title>Enforce Spectre v2 mitigation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_spectre_v2_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_ocil:questionnaire:1">
          <ocil:title>Configure Auto Configuration on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_vm_mmap_min_addr_ocil:questionnaire:1">
          <ocil:title>Prevent applications from mapping low portion of virtual memory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_vm_mmap_min_addr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_ipsec_conf_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/ipsec.conf File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_ipsec_conf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_gcc_plugin_structleak_ocil:questionnaire:1">
          <ocil:title>Force initialization of variables containing userspace addresses</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_gcc_plugin_structleak_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_ocil:questionnaire:1">
          <ocil:title>Emulate Privileged Access Never (PAN)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_srv_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /srv</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_srv_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1">
          <ocil:title>Disable the GNOME3 Login User List</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_ia32_emulation_ocil:questionnaire:1">
          <ocil:title>Disable IA32 emulation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_ia32_emulation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_disable_recovery_ocil:questionnaire:1">
          <ocil:title>Disable Recovery Booting</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_disable_recovery_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_nolisten_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_unique_name_ocil:questionnaire:1">
          <ocil:title>Ensure All Accounts on the System Have Unique Names</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_unique_name_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_cron_weekly_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns cron.weekly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_cron_weekly_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_smartcard_packages_ocil:questionnaire:1">
          <ocil:title>Install Smart Card Packages For Multifactor Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_smartcard_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_pti_argument_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Page-Table Isolation (KPTI)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_pti_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_netrc_files_ocil:questionnaire:1">
          <ocil:title>Verify No netrc Files Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_netrc_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - tallylog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_group_ownership_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Directories Must Be Group Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_group_ownership_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_home_directories_ocil:questionnaire:1">
          <ocil:title>All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_home_directories_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nss-tools_installed_ocil:questionnaire:1">
          <ocil:title>Ensure nss-tools is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nss-tools_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_at_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_sshd_private_key_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership on SSH Server Private *_key Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_sshd_private_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_sshd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable SSH Server If Possible</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_sshd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_polyinstantiated_var_tmp_ocil:questionnaire:1">
          <ocil:title>Configure Polyinstantiation of /var/tmp Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_daily_ocil:questionnaire:1">
          <ocil:title>Verify Owner on cron.daily</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_daily_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-timer_logrotate_enabled_ocil:questionnaire:1">
          <ocil:title>Enable logrotate Timer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-timer_logrotate_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_home_directories_ocil:questionnaire:1">
          <ocil:title>All Interactive User Home Directories Must Be Group-Owned By The Primary Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_home_directories_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1">
          <ocil:title>Set Default iptables Policy for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_iptables_default_rule_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1">
          <ocil:title>Remove Rsh Trust Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1">
          <ocil:title>Verify that All World-Writable Directories Have Sticky Bits Set</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_ocil:questionnaire:1">
          <ocil:title>Configure Auto Configuration on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_table_isolation_ocil:questionnaire:1">
          <ocil:title>Remove the kernel mapping in user mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_table_isolation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_kmod_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - kmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_kmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_telnet-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall telnet-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_telnet-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_owner_etc_selinux_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/selinux Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_owner_etc_selinux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1">
          <ocil:title>Install openscap-scanner Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openscap-scanner_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1">
          <ocil:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_logon_fail_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_crypttab_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/crypttab File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_crypttab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_chrony_keys_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/chrony.keys File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_chrony_keys_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_permissions_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_permissions_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_atd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable At Service (atd)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_atd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_sudoers_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects System Administrator Actions - /etc/sudoers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_sudoers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_stackprotector_strong_ocil:questionnaire:1">
          <ocil:title>Strong Stack Protector</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_stackprotector_strong_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_firewalld_ports_ocil:questionnaire:1">
          <ocil:title>Configure the Firewalld Ports</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_firewalld_ports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_policycoreutils-python-utils_installed_ocil:questionnaire:1">
          <ocil:title>Install policycoreutils-python-utils package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_policycoreutils-python-utils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_use_fips_hashes_ocil:questionnaire:1">
          <ocil:title>Configure AIDE to Use FIPS 140-2 for Validating Hashes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_use_fips_hashes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_host_based_files_ocil:questionnaire:1">
          <ocil:title>Remove Host-Based Authentication Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_host_based_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_nosmap_argument_absent_ocil:questionnaire:1">
          <ocil:title>Ensure SMAP is not disabled during boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_nosmap_argument_absent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1">
          <ocil:title>Verify iptables Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_ocil:questionnaire:1">
          <ocil:title>Enable different security models</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1">
          <ocil:title>Disable CAN Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_can_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_refcount_full_ocil:questionnaire:1">
          <ocil:title>Perform full reference count validation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_refcount_full_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1">
          <ocil:title>Enable rsyslog Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rsyslog_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1">
          <ocil:title>Restrict Serial Port Root Logins</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-restrict_serial_port_logins_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_overflow_action_ocil:questionnaire:1">
          <ocil:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_overflow_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_su_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1">
          <ocil:title>Configure SNMP Service to Use Only SNMPv3 or Newer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_use_newer_protocol_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_owner_etc_sudoersd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/sudoers.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_owner_etc_sudoersd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1">
          <ocil:title>Ensure that System Accounts Are Locked</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1">
          <ocil:title>Enable SSH Print Last Log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_print_last_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nosuid_remote_filesystems_ocil:questionnaire:1">
          <ocil:title>Mount Remote Filesystems with nosuid</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nosuid_remote_filesystems_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_ownership_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executable Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_ownership_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ssh_client_rekey_limit_ocil:questionnaire:1">
          <ocil:title>Configure session renegotiation for SSH client</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ssh_client_rekey_limit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_ssh_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_immutable_ocil:questionnaire:1">
          <ocil:title>Make the auditd Configuration Immutable</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_immutable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_pam_services_ocil:questionnaire:1">
          <ocil:title>Configure PAM in SSSD Services</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_pam_services_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Minimum Length in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_at_allow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/at.allow file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_at_allow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_crypttab_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /etc/crypttab File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_crypttab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slab_freelist_hardened_ocil:questionnaire:1">
          <ocil:title>Harden slab freelist metadata</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slab_freelist_hardened_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_panic_on_oops_ocil:questionnaire:1">
          <ocil:title>Kernel panic on oops</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1">
          <ocil:title>Set Default iptables Policy for Forwarded Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_iptables_default_rule_forward_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1">
          <ocil:title>Enable support for BUG()</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_xdmcp_ocil:questionnaire:1">
          <ocil:title>Disable XDMCP in GDM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Count Max to zero</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_keepalive_0_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rdisc_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Network Router Discovery Daemon (rdisc)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rdisc_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_enforce_root_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Enforce for root User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_enforce_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tuned_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall tuned Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tuned_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Modify the System Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_audit_auditd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /etc/audit/auditd.conf</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_audit_auditd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-bios_enable_execution_restrictions_ocil:questionnaire:1">
          <ocil:title>Enable NX or XD Support in the BIOS</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-bios_enable_execution_restrictions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1">
          <ocil:title>Configure Periodic Execution of AIDE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_periodic_cron_checking_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_unique_id_ocil:questionnaire:1">
          <ocil:title>Ensure All Accounts on the System Have Unique User IDs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_unique_id_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_bind_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall bind Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_bind_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_dev_shm_ocil:questionnaire:1">
          <ocil:title>Ensure /dev/shm is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_dev_shm_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_modify_ldt_syscall_ocil:questionnaire:1">
          <ocil:title>Disable the LDT (local descriptor table)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_modify_ldt_syscall_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_setfiles_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run setfiles</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_setfiles_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_auditadm_exec_content_ocil:questionnaire:1">
          <ocil:title>Enable the auditadm_exec_content SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_auditadm_exec_content_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_mcafeetp_installed_ocil:questionnaire:1">
          <ocil:title>Install McAfee Endpoint Security for Linux (ENSL)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_mcafeetp_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1">
          <ocil:title>Verify Any Configured IPSec Tunnel Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-libreswan_approved_tunnels_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1">
          <ocil:title>Implement Blank Screensaver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall gssproxy Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gssproxy_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-networkmanager_dns_mode_ocil:questionnaire:1">
          <ocil:title>NetworkManager DNS Mode Must Be Must Configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-networkmanager_dns_mode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_opt_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /opt</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_opt_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1">
          <ocil:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1">
          <ocil:title>Set Lockout Time for Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_security_yama_ocil:questionnaire:1">
          <ocil:title>Enable Yama support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_security_yama_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure OpenSSL library to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_openssl_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_ownership_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Directories Must Be Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_ownership_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_user_dot_user_ownership_ocil:questionnaire:1">
          <ocil:title>User Initialization Files Must Be Owned By the Primary User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_user_dot_user_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure Kerberos to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_ocil:questionnaire:1">
          <ocil:title>Drop Gratuitious ARP frames on All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_verify_acls_ocil:questionnaire:1">
          <ocil:title>Configure AIDE to Verify Access Control Lists (ACLs)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_verify_acls_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1">
          <ocil:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_audit_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Modify the System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1">
          <ocil:title>Disable ATM Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_atm_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_tls_cacert_ocil:questionnaire:1">
          <ocil:title>Configure CA certificate for rsyslog remote logging</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_tls_cacert_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_perm_change_failed_ocil:questionnaire:1">
          <ocil:title>Configure auditing of unsuccessful permission changes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_perm_change_failed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Image Loading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_bashrc_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Bash Umask is Set Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_root_gid_zero_ocil:questionnaire:1">
          <ocil:title>Verify Root Has A Primary GID 0</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_root_gid_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tftp_removed_ocil:questionnaire:1">
          <ocil:title>Remove tftp Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tftp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for Rhosts RSA Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_cron_daily_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on cron.daily</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_cron_daily_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_ocil:questionnaire:1">
          <ocil:title>Configure a Sufficiently Large Partition for Audit Logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_system_commands_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that system commands files are group owned by root or a system account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_system_commands_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_dovecot_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall dovecot Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_dovecot_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_access_monitoring_ocil:questionnaire:1">
          <ocil:title>Ensure remote access methods are monitored in Rsyslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_system_commands_group_root_owned_ocil:questionnaire:1">
          <ocil:title>Verify that system commands directories have root as a group owner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_system_commands_group_root_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_owner_etc_iptables_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/iptables Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_owner_etc_iptables_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1">
          <ocil:title>Disable Core Dumps for SUID programs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1">
          <ocil:title>Audit Configuration Files Must Be Owned By Group root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_audit_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1">
          <ocil:title>Disable Kerberos Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1">
          <ocil:title>Disable storing core dump</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coredump_disable_storage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_ocil:questionnaire:1">
          <ocil:title>Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_chage_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Networking Support Automatic Loading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_ocil:questionnaire:1">
          <ocil:title>Set Kernel Parameter to Increase Local Port Range</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_local_port_range_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rngd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the Hardware RNG Entropy Gatherer Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rngd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_sssd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the SSSD Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_sssd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1">
          <ocil:title>Disable TIPC Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_tipc_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_audit_ocil:questionnaire:1">
          <ocil:title>Account Lockouts Must Be Logged</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1">
          <ocil:title>Lock Accounts After Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_user_host_based_files_ocil:questionnaire:1">
          <ocil:title>Remove User Host-Based Authentication Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_user_host_based_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_setfacl_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run setfacl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_setfacl_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1">
          <ocil:title>Disable core dump backtraces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coredump_disable_backtraces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_immutable_login_uids_ocil:questionnaire:1">
          <ocil:title>Configure immutable Audit login UIDs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_immutable_login_uids_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict Exposed Kernel Pointer Addresses Access</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1">
          <ocil:title>Enable Use of Strict Mode Checking</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_strictmodes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_deny_ocil:questionnaire:1">
          <ocil:title>Verify Owner on cron.deny</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_ocil:questionnaire:1">
          <ocil:title>Configure Sending and Accepting Shared Media Redirects for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Warning Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-use_kerberos_security_all_exports_ocil:questionnaire:1">
          <ocil:title>Use Kerberos Security on All Exports</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-use_kerberos_security_all_exports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_tcp_rfc1337_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_tcp_rfc1337_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nodev_remote_filesystems_ocil:questionnaire:1">
          <ocil:title>Mount Remote Filesystems with nodev</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nodev_remote_filesystems_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for All yum Package Repositories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1">
          <ocil:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_requiretty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_deny_execmem_ocil:questionnaire:1">
          <ocil:title>Configure the deny_execmem SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_deny_execmem_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - truncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1">
          <ocil:title>Verify and Correct File Permissions with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_sudo_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_mce_argument_ocil:questionnaire:1">
          <ocil:title>Force kernel panic on uncorrected MCEs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_mce_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1">
          <ocil:title>Install rng-tools Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rng-tools_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for .rhosts Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_rhosts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_tmout_ocil:questionnaire:1">
          <ocil:title>Set Interactive Session Timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_tmout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1">
          <ocil:title>Set LogLevel to INFO</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_loglevel_info_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_owner_change_success_ocil:questionnaire:1">
          <ocil:title>Configure auditing of successful ownership changes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_owner_change_success_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_directory_configuration_ocil:questionnaire:1">
          <ocil:title>Distribute the SSH Server configuration to multiple files in a config directory.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_directory_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/security/opasswd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_sestatus_conf_ocil:questionnaire:1">
          <ocil:title>Verify Permissions On /etc/sestatus.conf File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_sestatus_conf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_verify_ext_attributes_ocil:questionnaire:1">
          <ocil:title>Configure AIDE to Verify Extended Attributes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_verify_ext_attributes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_set_min_life_existing_ocil:questionnaire:1">
          <ocil:title>Set Existing Passwords Minimum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_set_min_life_existing_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure System Cryptography Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - lastlog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1">
          <ocil:title>IOMMU configuration directive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_enable_iommu_force_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_devkmem_ocil:questionnaire:1">
          <ocil:title>Disable /dev/kmem virtual device support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_devkmem_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_server_directive_ocil:questionnaire:1">
          <ocil:title>Ensure Chrony is only configured with the server directive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_server_directive_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Minimum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1">
          <ocil:title>Install libreswan Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libreswan_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_systemd_debug-shell_argument_absent_ocil:questionnaire:1">
          <ocil:title>Ensure debug-shell service is not enabled during boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_systemd_debug-shell_argument_absent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_nmcli_permissions_ocil:questionnaire:1">
          <ocil:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_nmcli_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_dcredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_pubkey_auth_ocil:questionnaire:1">
          <ocil:title>Enable Public Key Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_pubkey_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1">
          <ocil:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_basic_configuration_ocil:questionnaire:1">
          <ocil:title>Configure basic parameters of Audit system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_basic_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Screensaver Lock After Idle Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_page_poison_argument_ocil:questionnaire:1">
          <ocil:title>Enable page allocator poisoning</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_page_poison_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_sudoedit_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_sctp_disabled_ocil:questionnaire:1">
          <ocil:title>Disable SCTP Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_sctp_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects System Administrator Actions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_cron_d_ocil:questionnaire:1">
          <ocil:title>Verify Owner on cron.d</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_cron_d_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>A remote time server for Chrony is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_users_home_files_groupownership_ocil:questionnaire:1">
          <ocil:title>All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_users_home_files_groupownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_password_selinux_faillock_dir_ocil:questionnaire:1">
          <ocil:title>An SELinux Context must be configured for the pam_faillock.so records directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_password_selinux_faillock_dir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_shells_ocil:questionnaire:1">
          <ocil:title>Verify Who Owns /etc/shells File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_shells_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1">
          <ocil:title>Verify All Account Password Hashes are Shadowed with SHA512</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_all_shadowed_sha512_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1">
          <ocil:title>Disable GDM Automatic Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Maximum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_no_command_negation_ocil:questionnaire:1">
          <ocil:title>Don't define allowed commands in sudoers by means of exclusion</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_no_command_negation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_slub_debug_ocil:questionnaire:1">
          <ocil:title>Enable SLUB debugging support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_slub_debug_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_disable_interactive_boot_ocil:questionnaire:1">
          <ocil:title>Verify that Interactive Boot is Disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_disable_interactive_boot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_user_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/user.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_user_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_delete_success_ocil:questionnaire:1">
          <ocil:title>Configure auditing of successful file deletions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_delete_success_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall iprutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_iprutils_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_ocil:questionnaire:1">
          <ocil:title>Limit sampling frequency of the Perf system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1">
          <ocil:title>Configure opensc Smart Card Drivers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_opensc_card_drivers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_set_post_pw_existing_ocil:questionnaire:1">
          <ocil:title>Set existing passwords a period of inactivity before they been locked</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_set_post_pw_existing_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_debug_fs_ocil:questionnaire:1">
          <ocil:title>Disable kernel debugfs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_debug_fs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_restorecon_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run restorecon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_restorecon_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - ftruncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_setroubleshoot-plugins_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall setroubleshoot-plugins Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1">
          <ocil:title>Disable DCCP Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_dccp_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_have_homedir_login_defs_ocil:questionnaire:1">
          <ocil:title>Ensure Home Directories are Created for New Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_have_homedir_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1">
          <ocil:title>Set SSH authentication attempt limit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_max_auth_tries_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nodev_removable_partitions_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to Removable Media Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nodev_removable_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_user_dot_group_ownership_ocil:questionnaire:1">
          <ocil:title>User Initialization Files Must Be Group-Owned By The Primary Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_user_dot_group_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_owner_etc_nftables_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/nftables Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_owner_etc_nftables_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_config_page_poisoning_zero_ocil:questionnaire:1">
          <ocil:title>Use zero for poisoning instead of debugging value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_config_page_poisoning_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwquality_system_auth_ocil:questionnaire:1">
          <ocil:title>Ensure PAM password complexity module is enabled in system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwquality_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_retry_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sebool_authlogin_radius_ocil:questionnaire:1">
          <ocil:title>Disable the authlogin_radius SELinux Boolean</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sebool_authlogin_radius_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_owner_etc_sysctld_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /etc/sysctl.d Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_owner_etc_sysctld_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-fapolicy_default_deny_ocil:questionnaire:1">
          <ocil:title>Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy to Allow the Execution of Authorized Software Programs.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-fapolicy_default_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_home_ocil:questionnaire:1">
          <ocil:title>Ensure /home Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_home_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_krb_sec_remote_filesystems_ocil:questionnaire:1">
          <ocil:title>Mount Remote Filesystems with Kerberos Security</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_krb_sec_remote_filesystems_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_spec_store_bypass_disable_argument_ocil:questionnaire:1">
          <ocil:title>Configure Speculative Store Bypass Mitigation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_spec_store_bypass_disable_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1">
          <ocil:title>Disallow Configuration to Bypass Password Requirements for Privilege Escalation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_sshd_pub_key_ocil:questionnaire:1">
          <ocil:title>Verify Ownership on SSH Server Public *.pub Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_sshd_pub_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
      </ocil:questionnaires>
      <ocil:test_actions>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_etc_nftables_action:testaction:1" question_ref="ocil:ssg-directory_permissions_etc_nftables_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_users_home_files_permissions_action:testaction:1" question_ref="ocil:ssg-accounts_users_home_files_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_rng_core_default_quality_argument_action:testaction:1" question_ref="ocil:ssg-grub2_rng_core_default_quality_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_talk-server_removed_action:testaction:1" question_ref="ocil:ssg-package_talk-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_vsyscall_xonly_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_vsyscall_xonly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_rds_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_rds_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_relayhost_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_relayhost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_monthly_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_monthly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-tftpd_uses_secure_mode_action:testaction:1" question_ref="ocil:ssg-tftpd_uses_secure_mode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-etc_system_fips_exists_action:testaction:1" question_ref="ocil:ssg-etc_system_fips_exists_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_squid_removed_action:testaction:1" question_ref="ocil:ssg-package_squid_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_vsyscall_argument_action:testaction:1" question_ref="ocil:ssg-grub2_vsyscall_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_sha512_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_ldap_start_tls_action:testaction:1" question_ref="ocil:ssg-sssd_ldap_start_tls_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_groupowner_etc_sysctld_action:testaction:1" question_ref="ocil:ssg-directory_groupowner_etc_sysctld_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_sudoers_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_sudoers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_etc_ipsecd_action:testaction:1" question_ref="ocil:ssg-directory_permissions_etc_ipsecd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_cron_logging_action:testaction:1" question_ref="ocil:ssg-rsyslog_cron_logging_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_dnf-automatic_installed_action:testaction:1" question_ref="ocil:ssg-package_dnf-automatic_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1" question_ref="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-clean_components_post_updating_action:testaction:1" question_ref="ocil:ssg-clean_components_post_updating_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_dhcp_removed_action:testaction:1" question_ref="ocil:ssg-package_dhcp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_systemmap_action:testaction:1" question_ref="ocil:ssg-file_permissions_systemmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_seccomp_filter_action:testaction:1" question_ref="ocil:ssg-kernel_config_seccomp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-require_emergency_target_auth_action:testaction:1" question_ref="ocil:ssg-require_emergency_target_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_nonroot_local_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_user_dot_no_world_writable_programs_action:testaction:1" question_ref="ocil:ssg-accounts_user_dot_no_world_writable_programs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_user_interactive_home_directory_defined_action:testaction:1" question_ref="ocil:ssg-accounts_user_interactive_home_directory_defined_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsh_removed_action:testaction:1" question_ref="ocil:ssg-package_rsh_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_tmp_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ssh_keys_passphrase_protected_action:testaction:1" question_ref="ocil:ssg-ssh_keys_passphrase_protected_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_not_disabled_action:testaction:1" question_ref="ocil:ssg-selinux_not_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_cron_installed_action:testaction:1" question_ref="ocil:ssg-package_cron_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_difok_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_difok_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_seccomp_action:testaction:1" question_ref="ocil:ssg-kernel_config_seccomp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_user_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_user_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-root_permissions_syslibrary_files_action:testaction:1" question_ref="ocil:ssg-root_permissions_syslibrary_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_users_home_files_ownership_action:testaction:1" question_ref="ocil:ssg-accounts_users_home_files_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_lcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_chronyd_enabled_action:testaction:1" question_ref="ocil:ssg-service_chronyd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_firewalld_installed_action:testaction:1" question_ref="ocil:ssg-package_firewalld_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_etc_sudoersd_action:testaction:1" question_ref="ocil:ssg-directory_permissions_etc_sudoersd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_config_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_config_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_root_password_configured_action:testaction:1" question_ref="ocil:ssg-ensure_root_password_configured_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hid_and_hub_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_sshd_enabled_action:testaction:1" question_ref="ocil:ssg-service_sshd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_net_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_net_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_perm_change_success_action:testaction:1" question_ref="ocil:ssg-audit_perm_change_success_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libselinux_installed_action:testaction:1" question_ref="ocil:ssg-package_libselinux_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_net-snmp_removed_action:testaction:1" question_ref="ocil:ssg-package_net-snmp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_ftp_removed_action:testaction:1" question_ref="ocil:ssg-package_ftp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_privileged_commands_poweroff_action:testaction:1" question_ref="ocil:ssg-audit_privileged_commands_poweroff_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_dmesg_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_umount2_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_ungroupowned_action:testaction:1" question_ref="ocil:ssg-file_permissions_ungroupowned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_audit_configuration_action:testaction:1" question_ref="ocil:ssg-file_permissions_audit_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_audit_rulesd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_audit_rulesd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_dedicated_group_action:testaction:1" question_ref="ocil:ssg-sudo_dedicated_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_srv_action:testaction:1" question_ref="ocil:ssg-partition_for_srv_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_randomize_base_action:testaction:1" question_ref="ocil:ssg-kernel_config_randomize_base_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_notifiers_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_notifiers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_minclass_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minclass_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_user_locks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_action:testaction:1" question_ref="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_db_up_to_date_action:testaction:1" question_ref="ocil:ssg-dconf_db_up_to_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_allow_only_protocol2_action:testaction:1" question_ref="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-wireless_disable_interfaces_action:testaction:1" question_ref="ocil:ssg-wireless_disable_interfaces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_create_success_action:testaction:1" question_ref="ocil:ssg-audit_create_success_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1" question_ref="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_opensc_installed_action:testaction:1" question_ref="ocil:ssg-package_opensc_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_authorized_local_users_action:testaction:1" question_ref="ocil:ssg-accounts_authorized_local_users_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_direct_root_logins_action:testaction:1" question_ref="ocil:ssg-no_direct_root_logins_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_enable_gssapi_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_audit_configuration_action:testaction:1" question_ref="ocil:ssg-file_ownership_audit_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_init_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_set_warn_age_existing_action:testaction:1" question_ref="ocil:ssg-accounts_password_set_warn_age_existing_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nfs-utils_removed_action:testaction:1" question_ref="ocil:ssg-package_nfs-utils_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_system_commands_root_owned_action:testaction:1" question_ref="ocil:ssg-dir_system_commands_root_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_cyrus-imapd_removed_action:testaction:1" question_ref="ocil:ssg-package_cyrus-imapd_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-encrypt_partitions_action:testaction:1" question_ref="ocil:ssg-encrypt_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_usrquota_action:testaction:1" question_ref="ocil:ssg-mount_option_home_usrquota_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_usermod_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_usermod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_execstack_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_execstack_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_enable_selinux_action:testaction:1" question_ref="ocil:ssg-grub2_enable_selinux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_access_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_access_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_uvcvideo_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_uvcvideo_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_temp_expire_date_action:testaction:1" question_ref="ocil:ssg-account_temp_expire_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_suid_privilege_function_action:testaction:1" question_ref="ocil:ssg-audit_rules_suid_privilege_function_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_ip6tables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_ip6tables_default_rule_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_passwords_pam_faillock_audit_action:testaction:1" question_ref="ocil:ssg-account_passwords_pam_faillock_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_setsebool_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_setsebool_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-securetty_root_login_console_only_action:testaction:1" question_ref="ocil:ssg-securetty_root_login_console_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_set_max_life_existing_action:testaction:1" question_ref="ocil:ssg-accounts_password_set_max_life_existing_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_disable_x11_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_priv_separation_action:testaction:1" question_ref="ocil:ssg-sshd_use_priv_separation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_at_deny_not_exist_action:testaction:1" question_ref="ocil:ssg-file_at_deny_not_exist_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sudo_installed_action:testaction:1" question_ref="ocil:ssg-package_sudo_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_max_sessions_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_sessions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_crontab_action:testaction:1" question_ref="ocil:ssg-file_groupowner_crontab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_shells_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_shells_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_weekly_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_weekly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_randstruct_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_randstruct_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-server_removed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_firewire-core_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rlogin_disabled_action:testaction:1" question_ref="ocil:ssg-service_rlogin_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_proc_kcore_action:testaction:1" question_ref="ocil:ssg-kernel_config_proc_kcore_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_modify_success_action:testaction:1" question_ref="ocil:ssg-audit_modify_success_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_dracut_fips_module_action:testaction:1" question_ref="ocil:ssg-enable_dracut_fips_module_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_sudoers_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_sudoers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_profile_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_profile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_prevent_unrestricted_relay_action:testaction:1" question_ref="ocil:ssg-postfix_prevent_unrestricted_relay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audit_installed_action:testaction:1" question_ref="ocil:ssg-package_audit_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_min_rounds_logindefs_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_min_rounds_logindefs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-firewalld_loopback_traffic_trusted_action:testaction:1" question_ref="ocil:ssg-firewalld_loopback_traffic_trusted_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_monthly_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_monthly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_hardened_usercopy_fallback_action:testaction:1" question_ref="ocil:ssg-kernel_config_hardened_usercopy_fallback_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_semanage_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_semanage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_custom_logfile_action:testaction:1" question_ref="ocil:ssg-sudo_custom_logfile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_users_coredumps_action:testaction:1" question_ref="ocil:ssg-disable_users_coredumps_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_core_uses_pid_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_core_uses_pid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_kerberos_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_kerberos_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-xwindows_remove_packages_action:testaction:1" question_ref="ocil:ssg-xwindows_remove_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_seunshare_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_seunshare_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_validate_passwd_action:testaction:1" question_ref="ocil:ssg-sudoers_validate_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_list_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_list_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_chrony_keys_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_chrony_keys_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_panic_on_oops_action:testaction:1" question_ref="ocil:ssg-kernel_config_panic_on_oops_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_modules_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_modules_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_log_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_no_chronyc_network_action:testaction:1" question_ref="ocil:ssg-chronyd_no_chronyc_network_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gnutls-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_gnutls-utils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_debug-shell_disabled_action:testaction:1" question_ref="ocil:ssg-service_debug-shell_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_randomize_memory_action:testaction:1" question_ref="ocil:ssg-kernel_config_randomize_memory_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_ipv6_action:testaction:1" question_ref="ocil:ssg-kernel_config_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_umount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_syslogng_enabled_action:testaction:1" question_ref="ocil:ssg-service_syslogng_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_execheap_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_execheap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_libreswan_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_execmod_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_execmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_cramfs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_chsh_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_groupowner_etc_iptables_action:testaction:1" question_ref="ocil:ssg-directory_groupowner_etc_iptables_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_pcsc-lite_installed_action:testaction:1" question_ref="ocil:ssg-package_pcsc-lite_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1" question_ref="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_finit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-display_login_attempts_action:testaction:1" question_ref="ocil:ssg-display_login_attempts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_configure_name_resolution_action:testaction:1" question_ref="ocil:ssg-network_configure_name_resolution_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_mds_argument_action:testaction:1" question_ref="ocil:ssg-grub2_mds_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_aide_installed_action:testaction:1" question_ref="ocil:ssg-package_aide_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rear_installed_action:testaction:1" question_ref="ocil:ssg-package_rear_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_home_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_firewalld_default_zone_action:testaction:1" question_ref="ocil:ssg-set_firewalld_default_zone_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_no_uid_except_zero_action:testaction:1" question_ref="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_syslogng_installed_action:testaction:1" question_ref="ocil:ssg-package_syslogng_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_user_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_user_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1" question_ref="ocil:ssg-sysctl_user_max_user_namespaces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dnf-automatic_apply_updates_action:testaction:1" question_ref="ocil:ssg-dnf-automatic_apply_updates_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-agent_mfetpd_running_action:testaction:1" question_ref="ocil:ssg-agent_mfetpd_running_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_ptys_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_ptys_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nosuid_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_nosuid_removable_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_media_export_action:testaction:1" question_ref="ocil:ssg-audit_rules_media_export_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_hourly_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_hourly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_efi_user_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_efi_user_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_state_action:testaction:1" question_ref="ocil:ssg-selinux_state_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_usbguard_auditbackend_action:testaction:1" question_ref="ocil:ssg-configure_usbguard_auditbackend_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_cron_monthly_action:testaction:1" question_ref="ocil:ssg-file_permissions_cron_monthly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_compat_vdso_action:testaction:1" question_ref="ocil:ssg-kernel_config_compat_vdso_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-firewalld-backend_action:testaction:1" question_ref="ocil:ssg-firewalld-backend_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_issue_net_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_issue_net_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-systemd_tmp_mount_enabled_action:testaction:1" question_ref="ocil:ssg-systemd_tmp_mount_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_efi_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_efi_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_groupowner_etc_selinux_action:testaction:1" question_ref="ocil:ssg-directory_groupowner_etc_selinux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_policytype_action:testaction:1" question_ref="ocil:ssg-selinux_policytype_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_vsyscall_none_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_vsyscall_none_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_nftables_disabled_action:testaction:1" question_ref="ocil:ssg-service_nftables_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_immutable_login_uids_action:testaction:1" question_ref="ocil:ssg-audit_immutable_login_uids_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gid_passwd_group_same_action:testaction:1" question_ref="ocil:ssg-gid_passwd_group_same_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_logrotate_activated_action:testaction:1" question_ref="ocil:ssg-ensure_logrotate_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1" question_ref="ocil:ssg-package_setroubleshoot-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_disable_post_pw_expiration_action:testaction:1" question_ref="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_audit_tools_permissions_action:testaction:1" question_ref="ocil:ssg-file_audit_tools_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_ipsec_conf_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_ipsec_conf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_sudo_log_events_action:testaction:1" question_ref="ocil:ssg-audit_sudo_log_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_writable_hooks_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_writable_hooks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-use_pam_wheel_for_su_action:testaction:1" question_ref="ocil:ssg-use_pam_wheel_for_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_kdump_disabled_action:testaction:1" question_ref="ocil:ssg-service_kdump_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_autorun_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_autorun_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_loghost_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_loghost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_syslog_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_syslog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_empty_passwords_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_privileged_commands_reboot_action:testaction:1" question_ref="ocil:ssg-audit_privileged_commands_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_syslog_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_syslog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permission_user_init_files_action:testaction:1" question_ref="ocil:ssg-file_permission_user_init_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_clock_settime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_slab_nomerge_argument_action:testaction:1" question_ref="ocil:ssg-grub2_slab_nomerge_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_password_action:testaction:1" question_ref="ocil:ssg-grub2_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_syslog_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_syslog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_allow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_allow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dnf-automatic_security_updates_only_action:testaction:1" question_ref="ocil:ssg-dnf-automatic_security_updates_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1" question_ref="ocil:ssg-sysctl_net_core_bpf_jit_harden_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_idle_timeout_action:testaction:1" question_ref="ocil:ssg-sshd_set_idle_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_permissions_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_csh_cshrc_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_binfmt_misc_action:testaction:1" question_ref="ocil:ssg-kernel_config_binfmt_misc_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1" question_ref="ocil:ssg-accounts_polyinstantiated_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_ipsec_secrets_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_ipsec_secrets_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_system_shutdown_action:testaction:1" question_ref="ocil:ssg-audit_rules_system_shutdown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_strict_kernel_rwx_action:testaction:1" question_ref="ocil:ssg-kernel_config_strict_kernel_rwx_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_retpoline_action:testaction:1" question_ref="ocil:ssg-kernel_config_retpoline_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_passwordauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_passwordauth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_smartcards_action:testaction:1" question_ref="ocil:ssg-sssd_enable_smartcards_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ufw_enabled_action:testaction:1" question_ref="ocil:ssg-service_ufw_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_var_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-firewalld_sshd_port_enabled_action:testaction:1" question_ref="ocil:ssg-firewalld_sshd_port_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_log_format_action:testaction:1" question_ref="ocil:ssg-auditd_log_format_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_ucredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_log_audit_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_usbguard_enabled_action:testaction:1" question_ref="ocil:ssg-service_usbguard_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_mac_modification_usr_share_action:testaction:1" question_ref="ocil:ssg-audit_rules_mac_modification_usr_share_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_offline_cred_expiration_action:testaction:1" question_ref="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_credentials_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_credentials_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_ownership_action:testaction:1" question_ref="ocil:ssg-rpm_verify_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_snmpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_snmpd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_hashes_action:testaction:1" question_ref="ocil:ssg-rpm_verify_hashes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_sshd_config_action:testaction:1" question_ref="ocil:ssg-file_groupowner_sshd_config_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_crypto-policies_installed_action:testaction:1" question_ref="ocil:ssg-package_crypto-policies_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_nosmep_argument_absent_action:testaction:1" question_ref="ocil:ssg-grub2_nosmep_argument_absent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audispd-plugins_installed_action:testaction:1" question_ref="ocil:ssg-package_audispd-plugins_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_slub_debug_argument_action:testaction:1" question_ref="ocil:ssg-grub2_slub_debug_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_vmap_stack_action:testaction:1" question_ref="ocil:ssg-kernel_config_vmap_stack_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_all_squash_exports_action:testaction:1" question_ref="ocil:ssg-no_all_squash_exports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_password_pam_faillock_system_auth_action:testaction:1" question_ref="ocil:ssg-account_password_pam_faillock_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_syn_cookies_action:testaction:1" question_ref="ocil:ssg-kernel_config_syn_cookies_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_name_format_action:testaction:1" question_ref="ocil:ssg-auditd_name_format_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_telnet_disabled_action:testaction:1" question_ref="ocil:ssg-service_telnet_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_etc_selinux_action:testaction:1" question_ref="ocil:ssg-directory_permissions_etc_selinux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_event_paranoid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_audit_tools_ownership_action:testaction:1" question_ref="ocil:ssg-file_audit_tools_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-logind_session_timeout_action:testaction:1" question_ref="ocil:ssg-logind_session_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_error_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_error_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_mac_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_mac_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_ipsec_secrets_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_ipsec_secrets_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_root_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_groupownership_sshd_pub_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_access_failed_action:testaction:1" question_ref="ocil:ssg-audit_access_failed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_telnet_removed_action:testaction:1" question_ref="ocil:ssg-package_telnet_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_strict_module_rwx_action:testaction:1" question_ref="ocil:ssg-kernel_config_strict_module_rwx_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_set_max_life_root_action:testaction:1" question_ref="ocil:ssg-accounts_password_set_max_life_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_disable_tcp_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_ownership_sshd_private_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_has_trust_anchor_action:testaction:1" question_ref="ocil:ssg-sssd_has_trust_anchor_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_use_pty_action:testaction:1" question_ref="ocil:ssg-sudo_add_use_pty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_secure_mode_insmod_action:testaction:1" question_ref="ocil:ssg-sebool_secure_mode_insmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_module_load_action:testaction:1" question_ref="ocil:ssg-audit_module_load_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_d_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_d_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_use_centralized_automated_auth_action:testaction:1" question_ref="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_cron_allow_action:testaction:1" question_ref="ocil:ssg-file_permissions_cron_allow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_no_root_target_action:testaction:1" question_ref="ocil:ssg-sudoers_no_root_target_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_full_action_stig_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_full_action_stig_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_policycoreutils_installed_action:testaction:1" question_ref="ocil:ssg-package_policycoreutils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-prefer_64bit_os_action:testaction:1" question_ref="ocil:ssg-prefer_64bit_os_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_scan_notification_action:testaction:1" question_ref="ocil:ssg-aide_scan_notification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_issue_net_action:testaction:1" question_ref="ocil:ssg-banner_etc_issue_net_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_mail_alias_postmaster_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_chrony_installed_action:testaction:1" question_ref="ocil:ssg-package_chrony_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_pid_max_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_pid_max_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_stackleak_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_stackleak_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_fips_mode_action:testaction:1" question_ref="ocil:ssg-enable_fips_mode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_empty_passwords_etc_shadow_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_files_unowned_by_user_action:testaction:1" question_ref="ocil:ssg-no_files_unowned_by_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_usbguard_installed_action:testaction:1" question_ref="ocil:ssg-package_usbguard_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_noexec_action:testaction:1" question_ref="ocil:ssg-sudo_add_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_postqueue_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_postqueue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_scap-security-guide_installed_action:testaction:1" question_ref="ocil:ssg-package_scap-security-guide_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_core_pattern_empty_string_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_core_pattern_empty_string_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_admin_username_action:testaction:1" question_ref="ocil:ssg-grub2_admin_username_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_delete_failed_action:testaction:1" question_ref="ocil:ssg-audit_delete_failed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwquality_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwquality_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_explicit_command_args_action:testaction:1" question_ref="ocil:ssg-sudoers_explicit_command_args_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_avahi-daemon_disabled_action:testaction:1" question_ref="ocil:ssg-service_avahi-daemon_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_pam_wheel_group_empty_action:testaction:1" question_ref="ocil:ssg-ensure_pam_wheel_group_empty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_core_pattern_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_x11_use_localhost_action:testaction:1" question_ref="ocil:ssg-sshd_x11_use_localhost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_panic_timeout_action:testaction:1" question_ref="ocil:ssg-kernel_config_panic_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_chrony_keys_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_chrony_keys_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_pcscd_enabled_action:testaction:1" question_ref="ocil:ssg-service_pcscd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_poisoning_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_poisoning_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_user_data_backups_action:testaction:1" question_ref="ocil:ssg-configure_user_data_backups_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_systemmap_action:testaction:1" question_ref="ocil:ssg-file_owner_systemmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_tmp_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_tmp_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_squid_disabled_action:testaction:1" question_ref="ocil:ssg-service_squid_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_crontab_action:testaction:1" question_ref="ocil:ssg-file_permissions_crontab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_remove_no_authenticate_action:testaction:1" question_ref="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_group_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_group_ownership_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_restrict_privilege_elevation_to_authorized_action:testaction:1" question_ref="ocil:ssg-sudo_restrict_privilege_elevation_to_authorized_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_privileged_commands_init_action:testaction:1" question_ref="ocil:ssg-audit_privileged_commands_init_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_bind_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_bind_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_regular_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_regular_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_auditd_enabled_action:testaction:1" question_ref="ocil:ssg-service_auditd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rsyncd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rsyncd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_owner_etc_ipsecd_action:testaction:1" question_ref="ocil:ssg-directory_owner_etc_ipsecd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_kexec_action:testaction:1" question_ref="ocil:ssg-kernel_config_kexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_rmdir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_adjtimex_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_run_as_chrony_user_action:testaction:1" question_ref="ocil:ssg-chronyd_run_as_chrony_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_pam_action:testaction:1" question_ref="ocil:ssg-sshd_enable_pam_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_network_listening_disabled_action:testaction:1" question_ref="ocil:ssg-postfix_network_listening_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_sestatus_conf_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_sestatus_conf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_error_action_stig_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1" question_ref="ocil:ssg-chronyd_or_ntpd_set_maxpoll_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_ssh_sysadm_login_action:testaction:1" question_ref="ocil:ssg-sebool_ssh_sysadm_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_systemmap_action:testaction:1" question_ref="ocil:ssg-file_groupowner_systemmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_noexec_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_noexec_remote_filesystems_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_maxstartups_action:testaction:1" question_ref="ocil:ssg-sshd_set_maxstartups_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_configure_pool_and_server_action:testaction:1" question_ref="ocil:ssg-chronyd_configure_pool_and_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_groupowner_etc_nftables_action:testaction:1" question_ref="ocil:ssg-directory_groupowner_etc_nftables_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_daily_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_daily_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_unix_update_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_unix_update_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_percentage_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_percentage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_modify_failed_action:testaction:1" question_ref="ocil:ssg-audit_modify_failed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_acpi_custom_method_action:testaction:1" question_ref="ocil:ssg-kernel_config_acpi_custom_method_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_root_password_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_password_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_interactive_users_action:testaction:1" question_ref="ocil:ssg-accounts_umask_interactive_users_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sssd_installed_action:testaction:1" question_ref="ocil:ssg-package_sssd_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-timer_dnf-automatic_enabled_action:testaction:1" question_ref="ocil:ssg-timer_dnf-automatic_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_crypttab_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_crypttab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_owner_change_failed_action:testaction:1" question_ref="ocil:ssg-audit_owner_change_failed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_user_interactive_home_directory_exists_action:testaction:1" question_ref="ocil:ssg-accounts_user_interactive_home_directory_exists_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_generate_policy_action:testaction:1" question_ref="ocil:ssg-usbguard_generate_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_compression_action:testaction:1" question_ref="ocil:ssg-sshd_disable_compression_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_confinement_of_daemons_action:testaction:1" question_ref="ocil:ssg-selinux_confinement_of_daemons_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_root_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_stime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_stime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_chcon_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_chcon_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_systemd-coredump_disabled_action:testaction:1" question_ref="ocil:ssg-service_systemd-coredump_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_home_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_groupownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_groupownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_etc_iptables_action:testaction:1" question_ref="ocil:ssg-directory_permissions_etc_iptables_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_flush_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_flush_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_sg_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_sg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_wx_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_wx_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1" question_ref="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_access_success_action:testaction:1" question_ref="ocil:ssg-audit_access_success_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-group_unique_id_action:testaction:1" question_ref="ocil:ssg-group_unique_id_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_s-nail_installed_action:testaction:1" question_ref="ocil:ssg-package_s-nail_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_issue_net_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_issue_net_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_ipsec_secrets_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_ipsec_secrets_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_fifos_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_fifos_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_action:testaction:1" question_ref="ocil:ssg-partition_for_var_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_ipsec_conf_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_ipsec_conf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_remove_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_remove_nopasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_tmp_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_tmp_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_autofs_disabled_action:testaction:1" question_ref="ocil:ssg-service_autofs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_issue_net_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_issue_net_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-xwindows_runlevel_target_action:testaction:1" question_ref="ocil:ssg-xwindows_runlevel_target_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_ctrlaltdel_burstaction_action:testaction:1" question_ref="ocil:ssg-disable_ctrlaltdel_burstaction_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1" question_ref="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_sudoers_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_sudoers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-security_patches_up_to_date_action:testaction:1" question_ref="ocil:ssg-security_patches_up_to_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_ospp_general_action:testaction:1" question_ref="ocil:ssg-audit_ospp_general_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_crond_enabled_action:testaction:1" question_ref="ocil:ssg-service_crond_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_cron_d_action:testaction:1" question_ref="ocil:ssg-file_permissions_cron_d_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsyslog_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_settimeofday_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_hash_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_hash_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-require_singleuser_auth_action:testaction:1" question_ref="ocil:ssg-require_singleuser_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_uefi_password_action:testaction:1" question_ref="ocil:ssg-grub2_uefi_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_tls_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_tls_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_cron_weekly_action:testaction:1" question_ref="ocil:ssg-file_permissions_cron_weekly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_fapolicyd_enabled_action:testaction:1" question_ref="ocil:ssg-service_fapolicyd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsh-server_removed_action:testaction:1" question_ref="ocil:ssg-package_rsh-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_compat_brk_action:testaction:1" question_ref="ocil:ssg-kernel_config_compat_brk_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slab_freelist_random_action:testaction:1" question_ref="ocil:ssg-kernel_config_slab_freelist_random_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sendmail_removed_action:testaction:1" question_ref="ocil:ssg-package_sendmail_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_full_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_full_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_require_reauthentication_action:testaction:1" question_ref="ocil:ssg-sudo_require_reauthentication_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_at_allow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_at_allow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_empty_passwords_action:testaction:1" question_ref="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_require_authentication_action:testaction:1" question_ref="ocil:ssg-sudo_require_authentication_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_certmap_action:testaction:1" question_ref="ocil:ssg-sssd_enable_certmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_hibernation_action:testaction:1" question_ref="ocil:ssg-kernel_config_hibernation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_l1tf_argument_action:testaction:1" question_ref="ocil:ssg-grub2_l1tf_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_limit_user_access_action:testaction:1" question_ref="ocil:ssg-sshd_limit_user_access_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_page_alloc_shuffle_argument_action:testaction:1" question_ref="ocil:ssg-grub2_page_alloc_shuffle_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_dconf_user_profile_action:testaction:1" question_ref="ocil:ssg-enable_dconf_user_profile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_authselect_action:testaction:1" question_ref="ocil:ssg-enable_authselect_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_x86_vsyscall_emulation_action:testaction:1" question_ref="ocil:ssg-kernel_config_x86_vsyscall_emulation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_sniffer_disabled_action:testaction:1" question_ref="ocil:ssg-network_sniffer_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_cron_deny_not_exist_action:testaction:1" question_ref="ocil:ssg-file_cron_deny_not_exist_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nftables_installed_action:testaction:1" question_ref="ocil:ssg-package_nftables_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_hourly_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_hourly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_oddjobd_disabled_action:testaction:1" question_ref="ocil:ssg-service_oddjobd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_last_change_is_in_past_action:testaction:1" question_ref="ocil:ssg-accounts_password_last_change_is_in_past_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tftp-server_removed_action:testaction:1" question_ref="ocil:ssg-package_tftp-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action_stig_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_action_stig_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_group_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_group_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_check_audit_tools_action:testaction:1" question_ref="ocil:ssg-aide_check_audit_tools_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configured_firewalld_default_deny_action:testaction:1" question_ref="ocil:ssg-configured_firewalld_default_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_audit_tools_group_ownership_action:testaction:1" question_ref="ocil:ssg-file_audit_tools_group_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_shells_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shells_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_login_grace_time_action:testaction:1" question_ref="ocil:ssg-sshd_set_login_grace_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_ownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_postfix_enabled_action:testaction:1" question_ref="ocil:ssg-service_postfix_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_faillock_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_faillock_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_home_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_home_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_etc_sysctld_action:testaction:1" question_ref="ocil:ssg-directory_permissions_etc_sysctld_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_sshd_config_action:testaction:1" question_ref="ocil:ssg-file_owner_sshd_config_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_privileged_commands_shutdown_action:testaction:1" question_ref="ocil:ssg-audit_privileged_commands_shutdown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_firewalld_enabled_action:testaction:1" question_ref="ocil:ssg-service_firewalld_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_chacl_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_chacl_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_quagga_removed_action:testaction:1" question_ref="ocil:ssg-package_quagga_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_client_only_action:testaction:1" question_ref="ocil:ssg-chronyd_client_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_ssh_agent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_certificate_verification_action:testaction:1" question_ref="ocil:ssg-sssd_certificate_verification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_sestatus_conf_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_sestatus_conf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_talk_removed_action:testaction:1" question_ref="ocil:ssg-package_talk_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_fortify_source_action:testaction:1" question_ref="ocil:ssg-kernel_config_fortify_source_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slab_merge_default_action:testaction:1" question_ref="ocil:ssg-kernel_config_slab_merge_default_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_rekey_limit_action:testaction:1" question_ref="ocil:ssg-sshd_rekey_limit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_cron_hourly_action:testaction:1" question_ref="ocil:ssg-file_permissions_cron_hourly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_password_pam_faillock_password_auth_action:testaction:1" question_ref="ocil:ssg-account_password_pam_faillock_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_freq_action:testaction:1" question_ref="ocil:ssg-auditd_freq_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_all_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_all_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-clients_installed_action:testaction:1" question_ref="ocil:ssg-package_openssh-clients_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1" question_ref="ocil:ssg-kernel_config_unmap_kernel_at_el0_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_ldap_configure_tls_reqcert_action:testaction:1" question_ref="ocil:ssg-sssd_ldap_configure_tls_reqcert_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_dictcheck_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dictcheck_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_efi_user_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_efi_user_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_sched_stack_end_check_action:testaction:1" question_ref="ocil:ssg-kernel_config_sched_stack_end_check_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_logrotate_installed_action:testaction:1" question_ref="ocil:ssg-package_logrotate_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_poisoning_no_sanity_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_poisoning_no_sanity_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_session_idle_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_session_idle_user_locks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-firewalld_loopback_traffic_restricted_action:testaction:1" question_ref="ocil:ssg-firewalld_loopback_traffic_restricted_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_polyinstantiation_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_polyinstantiation_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_key_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_build_database_action:testaction:1" question_ref="ocil:ssg-aide_build_database_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_groupowner_etc_sudoersd_action:testaction:1" question_ref="ocil:ssg-directory_groupowner_etc_sudoersd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_vsftpd_removed_action:testaction:1" question_ref="ocil:ssg-package_vsftpd_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_disable_inactivity_system_auth_action:testaction:1" question_ref="ocil:ssg-account_disable_inactivity_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_disable_inactivity_password_auth_action:testaction:1" question_ref="ocil:ssg-account_disable_inactivity_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1" question_ref="ocil:ssg-sysctl_crypto_fips_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_crontab_action:testaction:1" question_ref="ocil:ssg-file_owner_crontab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-dir_permissions_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_minlen_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minlen_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_groupowner_etc_ipsecd_action:testaction:1" question_ref="ocil:ssg-directory_groupowner_etc_ipsecd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_allow_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_allow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_hardened_usercopy_action:testaction:1" question_ref="ocil:ssg-kernel_config_hardened_usercopy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_open_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_pubkey_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-use_pam_wheel_group_for_su_action:testaction:1" question_ref="ocil:ssg-use_pam_wheel_group_for_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_passwords_pam_faillock_dir_action:testaction:1" question_ref="ocil:ssg-account_passwords_pam_faillock_dir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_dir_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_dir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_init_on_alloc_argument_action:testaction:1" question_ref="ocil:ssg-grub2_init_on_alloc_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_strong_macs_action:testaction:1" question_ref="ocil:ssg-sshd_use_strong_macs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_audit_backlog_limit_argument_action:testaction:1" question_ref="ocil:ssg-grub2_audit_backlog_limit_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_postfix_installed_action:testaction:1" question_ref="ocil:ssg-package_postfix_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_bug_on_data_corruption_action:testaction:1" question_ref="ocil:ssg-kernel_config_bug_on_data_corruption_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_deny_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_sysrq_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_sysrq_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_systemd-journald_enabled_action:testaction:1" question_ref="ocil:ssg-service_systemd-journald_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_ocredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_user_home_paths_only_action:testaction:1" question_ref="ocil:ssg-accounts_user_home_paths_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_default_mmap_min_addr_action:testaction:1" question_ref="ocil:ssg-kernel_config_default_mmap_min_addr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_host_auth_action:testaction:1" question_ref="ocil:ssg-disable_host_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_ownership_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_write_logs_action:testaction:1" question_ref="ocil:ssg-auditd_write_logs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_module_sig_force_action:testaction:1" question_ref="ocil:ssg-kernel_config_module_sig_force_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_legacy_vsyscall_emulate_action:testaction:1" question_ref="ocil:ssg-kernel_config_legacy_vsyscall_emulate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_create_failed_action:testaction:1" question_ref="ocil:ssg-audit_create_failed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_efi_user_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_efi_user_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_oracle_gpgkey_installed_action:testaction:1" question_ref="ocil:ssg-ensure_oracle_gpgkey_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_local_events_action:testaction:1" question_ref="ocil:ssg-auditd_local_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_stackprotector_action:testaction:1" question_ref="ocil:ssg-kernel_config_stackprotector_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_grpquota_action:testaction:1" question_ref="ocil:ssg-mount_option_home_grpquota_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-server_installed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_postdrop_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_postdrop_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_sudoers_d_action:testaction:1" question_ref="ocil:ssg-audit_rules_sudoers_d_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_forwarding_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_fapolicyd_installed_action:testaction:1" question_ref="ocil:ssg-package_fapolicyd_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_spectre_v2_argument_action:testaction:1" question_ref="ocil:ssg-grub2_spectre_v2_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_vm_mmap_min_addr_action:testaction:1" question_ref="ocil:ssg-sysctl_vm_mmap_min_addr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_ipsec_conf_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_ipsec_conf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_gcc_plugin_structleak_action:testaction:1" question_ref="ocil:ssg-kernel_config_gcc_plugin_structleak_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_action:testaction:1" question_ref="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_srv_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_srv_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_ia32_emulation_action:testaction:1" question_ref="ocil:ssg-kernel_config_ia32_emulation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_disable_recovery_action:testaction:1" question_ref="ocil:ssg-grub2_disable_recovery_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_nolisten_action:testaction:1" question_ref="ocil:ssg-rsyslog_nolisten_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_unique_name_action:testaction:1" question_ref="ocil:ssg-account_unique_name_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_cron_weekly_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_weekly_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_smartcard_packages_action:testaction:1" question_ref="ocil:ssg-install_smartcard_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_pti_argument_action:testaction:1" question_ref="ocil:ssg-grub2_pti_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_netrc_files_action:testaction:1" question_ref="ocil:ssg-no_netrc_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_tallylog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_group_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_group_ownership_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_home_directories_action:testaction:1" question_ref="ocil:ssg-file_permissions_home_directories_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nss-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_nss-tools_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_groupownership_sshd_private_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_sshd_disabled_action:testaction:1" question_ref="ocil:ssg-service_sshd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1" question_ref="ocil:ssg-accounts_polyinstantiated_var_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_daily_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_daily_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-timer_logrotate_enabled_action:testaction:1" question_ref="ocil:ssg-timer_logrotate_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_home_directories_action:testaction:1" question_ref="ocil:ssg-file_groupownership_home_directories_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_rsh_trust_files_action:testaction:1" question_ref="ocil:ssg-no_rsh_trust_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_table_isolation_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_table_isolation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_kmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_kmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_telnet-server_removed_action:testaction:1" question_ref="ocil:ssg-package_telnet-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_owner_etc_selinux_action:testaction:1" question_ref="ocil:ssg-directory_owner_etc_selinux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openscap-scanner_installed_action:testaction:1" question_ref="ocil:ssg-package_openscap-scanner_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_logon_fail_delay_action:testaction:1" question_ref="ocil:ssg-accounts_logon_fail_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_delete_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_crypttab_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_crypttab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_chrony_keys_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_chrony_keys_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_permissions_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_atd_disabled_action:testaction:1" question_ref="ocil:ssg-service_atd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_sudoers_action:testaction:1" question_ref="ocil:ssg-audit_rules_sudoers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_stackprotector_strong_action:testaction:1" question_ref="ocil:ssg-kernel_config_stackprotector_strong_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_firewalld_ports_action:testaction:1" question_ref="ocil:ssg-configure_firewalld_ports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_policycoreutils-python-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_policycoreutils-python-utils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_use_fips_hashes_action:testaction:1" question_ref="ocil:ssg-aide_use_fips_hashes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_host_based_files_action:testaction:1" question_ref="ocil:ssg-no_host_based_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_nosmap_argument_absent_action:testaction:1" question_ref="ocil:ssg-grub2_nosmap_argument_absent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_iptables_enabled_action:testaction:1" question_ref="ocil:ssg-service_iptables_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_can_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_can_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_refcount_full_action:testaction:1" question_ref="ocil:ssg-kernel_config_refcount_full_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rsyslog_enabled_action:testaction:1" question_ref="ocil:ssg-service_rsyslog_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-restrict_serial_port_logins_action:testaction:1" question_ref="ocil:ssg-restrict_serial_port_logins_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_overflow_action_action:testaction:1" question_ref="ocil:ssg-auditd_overflow_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_use_newer_protocol_action:testaction:1" question_ref="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_owner_etc_sudoersd_action:testaction:1" question_ref="ocil:ssg-directory_owner_etc_sudoersd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_print_last_log_action:testaction:1" question_ref="ocil:ssg-sshd_print_last_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nosuid_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_nosuid_remote_filesystems_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-dir_ownership_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ssh_client_rekey_limit_action:testaction:1" question_ref="ocil:ssg-ssh_client_rekey_limit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_ssh_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_ssh_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_immutable_action:testaction:1" question_ref="ocil:ssg-audit_rules_immutable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_pam_services_action:testaction:1" question_ref="ocil:ssg-sssd_enable_pam_services_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_at_allow_action:testaction:1" question_ref="ocil:ssg-file_permissions_at_allow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_crypttab_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_crypttab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slab_freelist_hardened_action:testaction:1" question_ref="ocil:ssg-kernel_config_slab_freelist_hardened_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_panic_on_oops_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_forward_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_bug_action:testaction:1" question_ref="ocil:ssg-kernel_config_bug_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_xdmcp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_0_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_0_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rdisc_disabled_action:testaction:1" question_ref="ocil:ssg-service_rdisc_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_enforce_root_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_enforce_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tuned_removed_action:testaction:1" question_ref="ocil:ssg-package_tuned_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_motd_action:testaction:1" question_ref="ocil:ssg-banner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_audit_auditd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_audit_auditd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-bios_enable_execution_restrictions_action:testaction:1" question_ref="ocil:ssg-bios_enable_execution_restrictions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_periodic_cron_checking_action:testaction:1" question_ref="ocil:ssg-aide_periodic_cron_checking_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_unique_id_action:testaction:1" question_ref="ocil:ssg-account_unique_id_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_bind_removed_action:testaction:1" question_ref="ocil:ssg-package_bind_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_dev_shm_action:testaction:1" question_ref="ocil:ssg-partition_for_dev_shm_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_modify_ldt_syscall_action:testaction:1" question_ref="ocil:ssg-kernel_config_modify_ldt_syscall_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_setfiles_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_setfiles_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_auditadm_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_auditadm_exec_content_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_mcafeetp_installed_action:testaction:1" question_ref="ocil:ssg-package_mcafeetp_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-libreswan_approved_tunnels_action:testaction:1" question_ref="ocil:ssg-libreswan_approved_tunnels_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gssproxy_removed_action:testaction:1" question_ref="ocil:ssg-package_gssproxy_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-networkmanager_dns_mode_action:testaction:1" question_ref="ocil:ssg-networkmanager_dns_mode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_opt_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_opt_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1" question_ref="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_security_yama_action:testaction:1" question_ref="ocil:ssg-kernel_config_security_yama_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_openssl_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_openssl_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_ownership_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_user_dot_user_ownership_action:testaction:1" question_ref="ocil:ssg-accounts_user_dot_user_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_kerberos_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_verify_acls_action:testaction:1" question_ref="ocil:ssg-aide_verify_acls_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_audit_argument_action:testaction:1" question_ref="ocil:ssg-grub2_audit_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_issue_action:testaction:1" question_ref="ocil:ssg-banner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_atm_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_atm_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_tls_cacert_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_tls_cacert_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_perm_change_failed_action:testaction:1" question_ref="ocil:ssg-audit_perm_change_failed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_bashrc_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_root_gid_zero_action:testaction:1" question_ref="ocil:ssg-accounts_root_gid_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tftp_removed_action:testaction:1" question_ref="ocil:ssg-package_tftp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_cron_daily_action:testaction:1" question_ref="ocil:ssg-file_permissions_cron_daily_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_system_commands_dirs_action:testaction:1" question_ref="ocil:ssg-file_groupownership_system_commands_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_dovecot_removed_action:testaction:1" question_ref="ocil:ssg-package_dovecot_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_access_monitoring_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_system_commands_group_root_owned_action:testaction:1" question_ref="ocil:ssg-dir_system_commands_group_root_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_owner_etc_iptables_action:testaction:1" question_ref="ocil:ssg-directory_owner_etc_iptables_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_audit_configuration_action:testaction:1" question_ref="ocil:ssg-file_groupownership_audit_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_kerb_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coredump_disable_storage_action:testaction:1" question_ref="ocil:ssg-coredump_disable_storage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_chage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rngd_enabled_action:testaction:1" question_ref="ocil:ssg-service_rngd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_sssd_enabled_action:testaction:1" question_ref="ocil:ssg-service_sssd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_tipc_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_audit_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_user_host_based_files_action:testaction:1" question_ref="ocil:ssg-no_user_host_based_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_setfacl_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_setfacl_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coredump_disable_backtraces_action:testaction:1" question_ref="ocil:ssg-coredump_disable_backtraces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_immutable_login_uids_action:testaction:1" question_ref="ocil:ssg-audit_rules_immutable_login_uids_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_strictmodes_action:testaction:1" question_ref="ocil:ssg-sshd_enable_strictmodes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_deny_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-use_kerberos_security_all_exports_action:testaction:1" question_ref="ocil:ssg-use_kerberos_security_all_exports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_tcp_rfc1337_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_tcp_rfc1337_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nodev_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_remote_filesystems_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_requiretty_action:testaction:1" question_ref="ocil:ssg-sudo_add_requiretty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_deny_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_deny_execmem_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_permissions_action:testaction:1" question_ref="ocil:ssg-rpm_verify_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_sudo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_mce_argument_action:testaction:1" question_ref="ocil:ssg-grub2_mce_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rng-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_rng-tools_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_tmout_action:testaction:1" question_ref="ocil:ssg-accounts_tmout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_info_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_info_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_owner_change_success_action:testaction:1" question_ref="ocil:ssg-audit_owner_change_success_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_directory_configuration_action:testaction:1" question_ref="ocil:ssg-sshd_use_directory_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_opasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_sestatus_conf_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_sestatus_conf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_verify_ext_attributes_action:testaction:1" question_ref="ocil:ssg-aide_verify_ext_attributes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_set_min_life_existing_action:testaction:1" question_ref="ocil:ssg-accounts_password_set_min_life_existing_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_lastlog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_enable_iommu_force_action:testaction:1" question_ref="ocil:ssg-grub2_enable_iommu_force_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_devkmem_action:testaction:1" question_ref="ocil:ssg-kernel_config_devkmem_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_server_directive_action:testaction:1" question_ref="ocil:ssg-chronyd_server_directive_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libreswan_installed_action:testaction:1" question_ref="ocil:ssg-package_libreswan_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_systemd_debug-shell_argument_absent_action:testaction:1" question_ref="ocil:ssg-grub2_systemd_debug-shell_argument_absent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_nmcli_permissions_action:testaction:1" question_ref="ocil:ssg-network_nmcli_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_dcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_pubkey_auth_action:testaction:1" question_ref="ocil:ssg-sshd_enable_pubkey_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_basic_configuration_action:testaction:1" question_ref="ocil:ssg-audit_basic_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_home_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_page_poison_argument_action:testaction:1" question_ref="ocil:ssg-grub2_page_poison_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_sudoedit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_sctp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_sctp_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1" question_ref="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_cron_d_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_d_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-chronyd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_users_home_files_groupownership_action:testaction:1" question_ref="ocil:ssg-accounts_users_home_files_groupownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_password_selinux_faillock_dir_action:testaction:1" question_ref="ocil:ssg-account_password_selinux_faillock_dir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_shells_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_shells_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_sha512_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_sha512_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_no_command_negation_action:testaction:1" question_ref="ocil:ssg-sudoers_no_command_negation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_slub_debug_action:testaction:1" question_ref="ocil:ssg-kernel_config_slub_debug_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_disable_interactive_boot_action:testaction:1" question_ref="ocil:ssg-grub2_disable_interactive_boot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_user_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_user_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_delete_success_action:testaction:1" question_ref="ocil:ssg-audit_delete_success_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_iprutils_removed_action:testaction:1" question_ref="ocil:ssg-package_iprutils_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_opensc_card_drivers_action:testaction:1" question_ref="ocil:ssg-configure_opensc_card_drivers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_set_post_pw_existing_action:testaction:1" question_ref="ocil:ssg-accounts_set_post_pw_existing_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_debug_fs_action:testaction:1" question_ref="ocil:ssg-kernel_config_debug_fs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_restorecon_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_restorecon_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1" question_ref="ocil:ssg-package_setroubleshoot-plugins_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_dccp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_have_homedir_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_have_homedir_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_max_auth_tries_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nodev_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_removable_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_user_dot_group_ownership_action:testaction:1" question_ref="ocil:ssg-accounts_user_dot_group_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_owner_etc_nftables_action:testaction:1" question_ref="ocil:ssg-directory_owner_etc_nftables_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_config_page_poisoning_zero_action:testaction:1" question_ref="ocil:ssg-kernel_config_page_poisoning_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwquality_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwquality_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_retry_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_retry_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sebool_authlogin_radius_action:testaction:1" question_ref="ocil:ssg-sebool_authlogin_radius_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_owner_etc_sysctld_action:testaction:1" question_ref="ocil:ssg-directory_owner_etc_sysctld_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-fapolicy_default_deny_action:testaction:1" question_ref="ocil:ssg-fapolicy_default_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_home_action:testaction:1" question_ref="ocil:ssg-partition_for_home_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_krb_sec_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_krb_sec_remote_filesystems_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_spec_store_bypass_disable_argument_action:testaction:1" question_ref="ocil:ssg-grub2_spec_store_bypass_disable_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disallow_bypass_password_sudo_action:testaction:1" question_ref="ocil:ssg-disallow_bypass_password_sudo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_ownership_sshd_pub_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
      </ocil:test_actions>
      <ocil:questions>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
          <ocil:question_text>Verify that yum verifies the signature of packages from a repository prior to install with the following command:

$ grep gpgcheck /etc/yum.conf

gpgcheck=1

If "gpgcheck" is not set to "1", or if the option is missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.
      Is it the case that there is no process to validate certificates that is approved by the organization?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "unix_chkpwd" command with the following command:

$ sudo auditctl -l | grep unix_chkpwd

-a always,exit -F path=/usr/bin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix_chkpwd
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.log_martians
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_etc_nftables_question:question:1">
          <ocil:question_text>To check the permissions of /etc/nftables,
run the command:
$ ls -l /etc/nftables
If properly configured, the output should indicate the following permissions:
0700
      Is it the case that /etc/nftables does not have unix mode 0700?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_users_home_files_permissions_question:question:1">
          <ocil:question_text>To verify all files and directories contained in interactive user home
directory, excluding local initialization files, have a mode of 0750,
run the following command:
$ sudo ls -lLR /home/USER
      Is it the case that home directory files or folders have incorrect permissions?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_grub2_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_rng_core_default_quality_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes rng_core.default_quality=,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*rng_core.default_quality=.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*rng_core.default_quality=.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'rng_core.default_quality='
The command should not return any output.
      Is it the case that trust on hardware random number generator is not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 defines default permissions for all authenticated users in such a way that the user can only read and modify their own files with the following command:

# grep -i umask /etc/login.defs

UMASK 
      Is it the case that the value for the "UMASK" parameter is not "&lt;sub idref="var_accounts_user_umask" /&gt;", or the "UMASK" parameter is missing or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_talk-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the talk-server package is installed:
$ rpm -q talk-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_vsyscall_xonly_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_VSYSCALL_XONLY /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_rds_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the rds kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the rds kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r rds /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_relayhost_question:question:1">
          <ocil:question_text>Run the following command to ensure postfix routes mail to this system:
$ grep relayhost /etc/postfix/main.cf
If properly configured, the output should show only .
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_monthly_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.monthly,
run the command:
$ ls -lL /etc/cron.monthly
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.monthly does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-tftpd_uses_secure_mode_question:question:1">
          <ocil:question_text>Verify the TFTP daemon is configured to operate in secure mode.

Check if a TFTP server is installed with the following command:

$ sudo dnf list --installed tftp-server

tftp-server.x86_64    5.2-35.el9.x86_64


If a TFTP server is not installed, this is Not Applicable.


If a TFTP server is installed, check for the server arguments with the following command:

$ systemctl cat tftp | grep ExecStart=
ExecStart=/usr/sbin/in.tftpd -s 
      Is it the case that 'the "ExecStart" line does not have a "-s" option, and a subdirectory is not assigned'?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-etc_system_fips_exists_question:question:1">
          <ocil:question_text>To verify /etc/system-fips exists, run the following command:
ls -l /etc/system-fips
The output should be similar to the following:
-rw-r--r--. 1 root root 36 Nov 26 11:31 /etc/system-fips
      Is it the case that /etc/system-fips does not exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_squid_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the squid package is installed:
$ rpm -q squid
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_vsyscall_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes vsyscall=none,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*vsyscall=none.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*vsyscall=none.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'vsyscall=none'
The command should not return any output.
      Is it the case that vsyscalls are enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_sha512_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_SHA512 /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the ipv6 on
network interfaces, it will contain a line of the form:
net.ipv6.conf.all.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory.
This permits insertion of the IPv6 kernel module (which other parts of the
system expect to be present), but otherwise keeps all network interfaces
from using IPv6. Run the following command to search for such lines in all
files in /etc/sysctl.d:
$ grep -r ipv6 /etc/sysctl.d
      Is it the case that the ipv6 support is disabled on all network interfaces?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_ldap_start_tls_question:question:1">
          <ocil:question_text>If the system is not using TLS, set the ldap_id_use_start_tls option
in /etc/sssd/sssd.conf to true.
      Is it the case that the 'ldap_id_use_start_tls' option is not set to 'true'?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
          <ocil:question_text>To verify that binaries cannot be directly executed from removable media, run the following command:
$ grep -v noexec /etc/fstab
The resulting output will show partitions which do not have the noexec flag. Verify all partitions
in the output are not removable media.
      Is it the case that removable media partitions are present?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_groupowner_etc_sysctld_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/sysctl.d,
run the command:
$ ls -lL /etc/sysctl.d
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/sysctl.d does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_sudoers_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/sudoers,
run the command:
$ ls -lL /etc/sudoers
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/sudoers does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
          <ocil:question_text>Verify that the libuser is set to encrypt password with a FIPS 140-3 approved cryptographic hashing algorithm.


Check the hashing algorithm that is being used to hash passwords with the following command:

$ sudo grep -i crypt_style /etc/libuser.conf

crypt_style = 
      Is it the case that crypt_style is not set to sha512?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_symlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_symlinks
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_etc_ipsecd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ipsec.d,
run the command:
$ ls -l /etc/ipsec.d
If properly configured, the output should indicate the following permissions:
0700
      Is it the case that /etc/ipsec.d does not have unix mode 0700?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
          <ocil:question_text>To obtain a listing of all users, their UIDs, and their shells, run the command:
$ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd
Identify the system accounts from this listing. These will primarily be the accounts with UID
numbers less than 1000, other than root.
      Is it the case that any system account other than root has a login shell?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /var/log mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log\s'
    . . . /var/log . . . nodev . . .

      Is it the case that the "/var/log" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_cron_logging_question:question:1">
          <ocil:question_text>Verify that cron is logging to rsyslog,
run the following command:
grep -rni "cron\.\*" /etc/rsyslog.*
cron.*                                                  /var/log/cron
or
cron.* action(type="omfile" file="/var/log/cron")
      Is it the case that cron is not logging to rsyslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_dnf-automatic_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the dnf-automatic package is installed: $ rpm -q dnf-automatic
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 limits the number of concurrent sessions to
"" for all
accounts and/or account types with the following command:
$ grep -r -s maxlogins /etc/security/limits.conf /etc/security/limits.d/*.conf
/etc/security/limits.conf:* hard maxlogins 10
This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.
      Is it the case that the "maxlogins" item is missing, commented out, or the value is set greater
than "&lt;sub idref="var_accounts_max_concurrent_login_sessions" /&gt;" and
is not documented with the Information System Security Officer (ISSO) as an
operational requirement for all domains that have the "maxlogins" item
assigned'?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-clean_components_post_updating_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 removes all software components after updated versions have been installed.


$ grep clean_requirements_on_remove /etc/yum.conf
clean_requirements_on_remove=1
      Is it the case that '"clean_requirements_on_remove" is not set to "1"'?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_dhcp_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the dhcp-server package is installed:
$ rpm -q dhcp-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_systemmap_question:question:1">
          <ocil:question_text>To check the permissions of /boot/System.map*,
run the command:
$ ls -l /boot/System.map*
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /boot/System.map* does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_seccomp_filter_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECCOMP_FILTER /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-require_emergency_target_auth_question:question:1">
          <ocil:question_text>To check if authentication is required for emergency mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/emergency.service
The output should be similar to the following, and the line must begin with
ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency

Then, check if the emergency target requires the emergency service:
Run the following command:
$ sudo grep Requires /usr/lib/systemd/system/emergency.target
The output should be the following:
Requires=emergency.service

Then, check if there is no custom emergency target configured in systemd configuration.
Run the following command:
$ sudo grep -r emergency.target /etc/systemd/system/
The output should be empty.

Then, check if there is no custom emergency service configured in systemd configuration.
Run the following command:
$ sudo grep -r emergency.service /etc/systemd/system/
The output should be empty.
      Is it the case that the output is different?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_keepalive_question:question:1">
          <ocil:question_text>To ensure ClientAliveInterval is set correctly, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveCountMax 
For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes a timeout precisely when
the ClientAliveInterval is set.  Starting with v8.2, a value of 0 disables the timeout
functionality completely.
If the option is set to a number greater than 0, then the session will be disconnected after
ClientAliveInterval * ClientAliveCountMax seconds without receiving a keep alive message.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for non-root local partitions, run the following command:
$ sudo mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev'
The output shows local non-root partitions mounted without the nodev option, and there should be no output at all.

      Is it the case that some mounts appear among output lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_user_dot_no_world_writable_programs_question:question:1">
          <ocil:question_text>Verify that local initialization files do not execute world-writable programs with the following command:

Note: The example will be for a system that is configured to create user home directories in the "/home" directory.

$ sudo find /home -perm -002 -type f -name ".[^.]*" -exec ls -ld {} \;
      Is it the case that any local initialization files are found to reference world-writable files?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_user_interactive_home_directory_defined_question:question:1">
          <ocil:question_text>Verify that interactive users on the system have a home directory assigned with the following command:

$ sudo awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd

Inspect the output and verify that all interactive users (normally users with a UID greater than 1000) have a home directory defined.
      Is it the case that users home directory is not defined?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/tmp\s'
    . . . /tmp . . . nodev . . .

      Is it the case that the "/tmp" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsh_removed_question:question:1">
          <ocil:question_text>The rsh package can be removed with the following command:  $ sudo yum erase rsh
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_tmp_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /var/tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/var/tmp\s'
    . . . /var/tmp . . . nosuid . . .

      Is it the case that the "/var/tmp" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ssh_keys_passphrase_protected_question:question:1">
          <ocil:question_text>For each private key stored on the system, use the following command:
$ sudo ssh-keygen -y -f /path/to/file
If the contents of the key are displayed, this is a finding.
      Is it the case that no ssh private key is accessible without a passcode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_not_disabled_question:question:1">
          <ocil:question_text>Ensure that Oracle Linux 9 does not disable SELinux.

Check if "SELinux" is active and in "enforcing" or "permissive" mode with the following command:

$ sudo getenforce
Enforcing
-OR-
Permissive
      Is it the case that SELinux is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_cron_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the cronie package is installed:
$ rpm -q cronie
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_difok_question:question:1">
          <ocil:question_text>Verify the value of the "difok" option in "/etc/security/pwquality.conf" with the following command:

$ sudo grep difok /etc/security/pwquality.conf

difok = 
      Is it the case that the value of "difok" is set to less than "&lt;sub idref="var_password_pam_difok" /&gt;", or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_seccomp_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECCOMP /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
          <ocil:question_text>To ensure that remote access requires credentials, run the following command:
$ gsettings get org.gnome.Vino authentication-methods
If properly configured, the output should be false.
To ensure that users cannot disable credentials for remote access, run the following:
$ grep authentication-methods /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/authentication-methods
      Is it the case that wireless network notification is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_user_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/grub2/user.cfg,
run the command:
$ ls -lL /boot/grub2/user.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/grub2/user.cfg does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_ownership_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library directories are owned by "root" with the following command:

$ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -user root -type d -exec stat -c "%n %U" '{}' \;
      Is it the case that any system-wide shared library directory is not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-root_permissions_syslibrary_files_question:question:1">
          <ocil:question_text>Verify the system-wide shared library files are group-owned by "root" with the following command:

$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -group root -exec ls -l {} \;
      Is it the case that any system wide shared library file is returned and is not group-owned by a required system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
          <ocil:question_text>To verify ExecShield is enabled on 64-bit Oracle Linux 9 systems,
run the following command:
$ dmesg | grep '[NX|DX]*protection'
The output should not contain 'disabled by kernel command line option'.
Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes noexec=off,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*noexec=off.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*noexec=off.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'noexec=off'
The command should not return any output.
      Is it the case that ExecShield is not supported by the hardware, is not enabled, or has been disabled by the kernel configuration.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd with the following command:

$  sudo auditctl -l | grep -E '(/etc/shadow)'

-w /etc/shadow -p wa -k identity
      Is it the case that command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_users_home_files_ownership_question:question:1">
          <ocil:question_text>To verify all files and directories in a local interactive user's
home directory have a valid owner, run the following command:
$ sudo ls -lLR /home/USER
      Is it the case that the user ownership is incorrect?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces password complexity by requiring that at least one lower-case character.

Check the value for "lcredit" with the following command:

$ sudo grep lcredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

/etc/security/pwquality.conf:lcredit = -1
      Is it the case that the value of "lcredit" is a positive number or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_chronyd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
chronyd service:
$ sudo systemctl is-active chronyd
If the service is running, it should return the following: active
      Is it the case that the chronyd process is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_firewalld_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the firewalld package is installed: $ rpm -q firewalld
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_etc_sudoersd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/sudoers.d,
run the command:
$ ls -l /etc/sudoers.d
If properly configured, the output should indicate the following permissions:
0750
      Is it the case that /etc/sudoers.d does not have unix mode 0750?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
          <ocil:question_text>To check the current idle time-out value, run the following command:
$ gsettings get org.gnome.desktop.session idle-delay
If properly configured, the output should be 'uint32 '.
To ensure that users cannot change the screensaver inactivity timeout setting, run the following:
$ grep idle-delay /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/session/idle-delay
      Is it the case that idle-delay is set to 0 or a value greater than &lt;sub idref="inactivity_timeout_value" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:
auditctl -l | grep -E '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_config_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/sshd_config,
run the command:
$ ls -l /etc/ssh/sshd_config
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /etc/ssh/sshd_config does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_root_password_configured_question:question:1">
          <ocil:question_text>root password is not set
      Is it the case that Perform the following to determine if a password is set for the
root user:
&lt;pre&gt;# grep -Eq '^root:\$[0-9]' /etc/shadow || echo "root is locked"&lt;/pre&gt;
No results should be returned.
Otherwise, run the following command and follow the prompts to set a
password for the root user:
&lt;pre&gt;# passwd root&lt;/pre&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hid_and_hub_question:question:1">
          <ocil:question_text>To verify that USB Human Interface Devices and hubs will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
The output lines should include
allow with-interface match-all { 03:*:* 09:00:* }
      Is it the case that USB devices of class 3 and 9:00 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_tmp_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /tmp with the following command:

$ mountpoint /tmp

      Is it the case that "/tmp is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_sshd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
sshd service:
$ sudo systemctl is-active sshd
If the service is running, it should return the following: active
      Is it the case that sshd service is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following
permissions: -rw-------
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_warning_banner_net_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's Banner option is set, run the following command:

$ sudo grep -i Banner /etc/ssh/sshd_config

If a line indicating /etc/issue.net is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_ignore_bogus_error_responses
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_perm_change_success_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-5-perm-change-success.rules
The output has to be exactly as follows:
## Successful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-perm-change    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the bluetooth kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the bluetooth kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libselinux_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libselinux package is installed: $ rpm -q libselinux
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_gshadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/gshadow,
run the command:
$ ls -lL /etc/gshadow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/gshadow does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_net-snmp_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the net-snmp package is installed:
$ rpm -q net-snmp
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_ftp_removed_question:question:1">
          <ocil:question_text>The ftp package can be removed with the following command:  $ sudo yum erase ftp
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_privileged_commands_poweroff_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "poweroff" command with the following command:

$ sudo auditctl -l | grep poweroff

-a always,exit -F path=/poweroff -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-poweroff
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_dmesg_restrict_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY_DMESG_RESTRICT /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/gshadow-,
run the command:
$ ls -lL /etc/gshadow-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/gshadow- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_messages_question:question:1">
          <ocil:question_text>To check the ownership of /var/log/messages,
run the command:
$ ls -lL /var/log/messages
If properly configured, the output should indicate the following owner:
root
      Is it the case that /var/log/messages does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_umount2_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
umount2 system call, run the following command:
$ sudo grep "umount2" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_ungroupowned_question:question:1">
          <ocil:question_text>The following command will locate the mount points related to local devices:
$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

The following command will show files which do not belong to a valid group:
$ sudo find MOUNTPOINT -xdev -nogroup 2&gt;/dev/null

Replace MOUNTPOINT by the mount points listed by the fist command.

No files without a valid group should be located.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /dev/shm mount point,
    run the following command:
    $ sudo mount | grep '\s/dev/shm\s'
    . . . /dev/shm . . . nosuid . . .

      Is it the case that the "/dev/shm" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_audit_configuration_question:question:1">
          <ocil:question_text>
To properly set the permissions of /etc/audit/, run the command:
$ sudo chmod 0640 /etc/audit/

To properly set the permissions of /etc/audit/rules.d/, run the command:
$ sudo chmod 0640 /etc/audit/rules.d/
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_audit_rulesd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/audit/rules.d/*.rules,
run the command:
$ ls -l /etc/audit/rules.d/*.rules
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /etc/audit/rules.d/*.rules does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_dedicated_group_question:question:1">
          <ocil:question_text>To check the group ownership of /usr/bin/sudo,
run the command:
$ ls -lL /usr/bin/sudo
If properly configured, the output should indicate the following group-owner:

      Is it the case that /usr/bin/sudo does not have a group owner of &lt;sub idref="var_sudo_dedicated_group" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_srv_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /srv with the following command:

$ mountpoint /srv

      Is it the case that "/srv is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_randomize_base_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_RANDOMIZE_BASE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_notifiers_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_NOTIFIERS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:

$ grep fail_interval /etc/security/faillock.conf
The output should show fail_interval = &lt;interval-in-seconds&gt; where interval-in-seconds is  or greater.
      Is it the case that the "fail_interval" option is not set to "&lt;sub idref="var_accounts_passwords_pam_faillock_fail_interval" /&gt;"
or less (but not "0"), the line is commented out, or the line is missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_minclass_question:question:1">
          <ocil:question_text>Verify the value of the "minclass" option in "/etc/security/pwquality.conf" with the following command:

$ grep minclass /etc/security/pwquality.conf

minclass = 
      Is it the case that the value of "minclass" is set to less than "&lt;sub idref="var_password_pam_minclass" /&gt;" or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its network configuration,
run the following command:
auditctl -l | grep -E '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'

If the system is configured to watch for network configuration changes, a line should be returned for
each file specified (and perm=wa should be indicated for each).
      Is it the case that the system is not configured to audit changes of the network configuration?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_user_locks_question:question:1">
          <ocil:question_text>To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'lock-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return:
/org/gnome/desktop/screensaver/lock-delay
      Is it the case that GNOME3 session settings are not locked or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_question:question:1">
          <ocil:question_text>
Run the following command to determine if the authlogin_nsswitch_use_ldap SELinux boolean is disabled:
$ getsebool authlogin_nsswitch_use_ldap
If properly configured, the output should show the following:
authlogin_nsswitch_use_ldap --&gt; off
      Is it the case that authlogin_nsswitch_use_ldap is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_db_up_to_date_question:question:1">
          <ocil:question_text>In order to be sure that the databases are up-to-date, run the
dconf update
command as the administrator.
      Is it the case that The system-wide dconf databases are up-to-date with regards to respective keyfiles?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_all_shadowed_question:question:1">
          <ocil:question_text>To check that no password hashes are stored in
/etc/passwd, run the following command:
awk '!/\S:x|\*/ {print}' /etc/passwd
If it produces any output, then a password hash is
stored in /etc/passwd.
      Is it the case that any stored hashes are found in /etc/passwd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
          <ocil:question_text>To check which SSH protocol version is allowed, check version of openssh-server with following command:

$ rpm -qi openssh-server | grep Version

Versions equal to or higher than 7.4 only allow Protocol 2.
If version is lower than 7.4, run the following command to check configuration:
$ sudo grep Protocol /etc/ssh/sshd_config
If configured properly, output should be Protocol 2
      Is it the case that it is commented out or is not set correctly to Protocol 2?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-wireless_disable_interfaces_question:question:1">
          <ocil:question_text>Verify that there are no wireless interfaces configured on the system
with the following command:

Note: This requirement is Not Applicable for systems that do not have physical wireless network radios.

$ nmcli device status
DEVICE          TYPE      STATE         CONNECTION
virbr0          bridge    connected     virbr0
wlp7s0          wifi      connected     wifiSSID
enp6s0          ethernet  disconnected  --
p2p-dev-wlp7s0  wifi-p2p  disconnected  --
lo              loopback  unmanaged     --
virbr0-nic      tun       unmanaged     --
      Is it the case that a wireless interface is configured and has not been documented and approved by the Information System Security Officer (ISSO)?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_create_success_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-1-create-success.rules
The output has to be exactly as follows:
## Successful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b32 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create
-a always,exit -F arch=b64 -S creat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-create    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the cryptsetup package is installed: $ rpm -q cryptsetup
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
          <ocil:question_text>To ensure the system is configured to mask the Ctrl-Alt-Del sequence, Check
that the ctrl-alt-del.target is masked and not active with the following
command:
sudo systemctl status ctrl-alt-del.target
The output should indicate that the target is masked and not active. It
might resemble following output:
ctrl-alt-del.target
Loaded: masked (/dev/null; bad)
Active: inactive (dead)
      Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_opensc_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the opensc package is installed: $ rpm -q opensc
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_authorized_local_users_question:question:1">
          <ocil:question_text>To verify that there are no unauthorized local user accounts, run the following command:
$ less /etc/passwd 
Inspect the results, and if unauthorized local user accounts exist, remove them by running
the following command:
$ sudo userdel unauthorized_user
      Is it the case that there are unauthorized local user accounts on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_direct_root_logins_question:question:1">
          <ocil:question_text>To ensure root may not directly login to the system over physical consoles,
run the following command:
cat /etc/securetty
If any output is returned, this is a finding.
      Is it the case that the /etc/securetty file is not empty?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_gssapi_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's GSSAPIAuthentication option is set, run the following command:

$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_audit_configuration_question:question:1">
          <ocil:question_text>
To properly set the owner of /etc/audit/, run the command:
$ sudo chown root /etc/audit/ 

To properly set the owner of /etc/audit/rules.d/, run the command:
$ sudo chown root /etc/audit/rules.d/ 
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_init_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_set_warn_age_existing_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 set the days of warning before a password expires to
 or more for users with a
password:

$ sudo awk -F: '$6  || $6 == "" {print $1}' /etc/shadow
      Is it the case that any results are returned that are not associated with a system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nfs-utils_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nfs-utils package is installed:
$ rpm -q nfs-utils
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_system_commands_root_owned_question:question:1">
          <ocil:question_text>System commands are stored in the following directories:
/bin 
/sbin 
/usr/bin 
/usr/sbin 
/usr/local/bin 
/usr/local/sbin
For each of these directories, run the following command to find directories not
owned by root:
$ sudo find -L $DIR ! -user root -type d
      Is it the case that any of these directories are not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_group_question:question:1">
          <ocil:question_text>To check the ownership of /etc/group,
run the command:
$ ls -lL /etc/group
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/group does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_cyrus-imapd_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the cyrus-imapd package is installed:
$ rpm -q cyrus-imapd
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-encrypt_partitions_question:question:1">
          <ocil:question_text>Check the system partitions to determine if they are encrypted with the following command:
blkid

Output will be similar to:
/dev/sda1: UUID=" ab12c3de-4f56-789a-8f33-3850cc8ce3a2
" TYPE="crypto_LUKS"
/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2
" TYPE="crypto_LUKS"

The boot partition and pseudo-file systems, such as /proc, /sys, and tmpfs,
are not required to use disk encryption and are not a finding.
      Is it the case that partitions do not have a type of crypto_LUKS?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
renameat system call, run the following command:
$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_usrquota_question:question:1">
          <ocil:question_text>Verify the usrquota option is configured for the /home mount point,
    run the following command:
    $ sudo mount | grep '\s/home\s'
    . . . /home . . . usrquota . . .

      Is it the case that the "/home" file system does not have the "usrquota" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_usermod_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "usermod" command with the following command:

$ sudo auditctl -l | grep usermod

-a always,exit -F path=/usr/bin/usermod -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-usermod
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_selinuxuser_execstack_question:question:1">
          <ocil:question_text>
Run the following command to determine if the selinuxuser_execstack SELinux boolean is disabled:
$ getsebool selinuxuser_execstack
If properly configured, the output should show the following:
selinuxuser_execstack --&gt; off
      Is it the case that selinuxuser_execstack is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_enable_selinux_question:question:1">
          <ocil:question_text>Inspect /etc/default/grub for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.
      Is it the case that SELinux is disabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_access_var_log_audit_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit accesses to
/var/log/audit directory, run the following command:
$ sudo grep "dir=/var/log/audit" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_uvcvideo_disabled_question:question:1">
          <ocil:question_text>If the device or Oracle Linux 9 does not have a camera installed, this requirement is not applicable.

This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.

This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.

For an external camera, if there is not a method for the operator to manually disconnect the camera at the end of collaborative computing sessions, this is a finding.

For a built-in camera, the camera must be protected by a camera cover (e.g., laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or is not physically disabled, this is a finding.

If the camera is not disconnected, covered, or physically disabled, determine if it is being disabled via software with the following commands:

Verify the operating system disables the ability to load the uvcvideo kernel module.

$ sudo grep -r uvcvideo /etc/modprobe.d/* | grep "/bin/true"

install uvcvideo /bin/true
      Is it the case that the command does not return any output, or the line is commented out, and the collaborative computing device has not been authorized for use?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_temp_expire_date_question:question:1">
          <ocil:question_text>Verify that temporary accounts have been provisioned with an expiration date
of 72 hours. For every temporary account, run the following command to
obtain its account aging and expiration information:
$ sudo chage -l temporary_account_name
Verify each of these accounts has an expiration date set within 72 hours or
as documented.
      Is it the case that any temporary accounts have no expiration date set or do not expire within 72 hours?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_suid_privilege_function_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 audits the execution of privileged functions.

Check if Oracle Linux 9 is configured to audit the execution of the "execve" system call using the following command:

$ sudo grep execve /etc/audit/audit.rules

The output should be the following:


-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
      Is it the case that the command does not return all lines, or the lines are commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_ip6tables_default_rule_question:question:1">
          <ocil:question_text>If IPv6 is disabled, this is not applicable.

Inspect the file /etc/sysconfig/ip6tables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/ip6tables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_passwords_pam_faillock_audit_question:question:1">
          <ocil:question_text>Verify the "/etc/security/faillock.conf" file is configured to log user name information when unsuccessful logon attempts occur:

$ sudo grep audit /etc/security/faillock.conf

audit
      Is it the case that the "audit" option is not set, is missing or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_setsebool_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "setsebool" command with the following command:

$ sudo auditctl -l | grep setsebool

-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library files contained in the following directories have mode "755" or less permissive with the following command:

$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 -perm /022 -type f -exec ls -l {} \;
      Is it the case that any system-wide shared library file is found to be group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-securetty_root_login_console_only_question:question:1">
          <ocil:question_text>To check for virtual console entries which permit root login, run the
following command:
$ sudo grep ^vc/[0-9] /etc/securetty
If any output is returned, then root logins over virtual console devices is permitted.
      Is it the case that root login over virtual console devices is permitted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
          <ocil:question_text>The runtime status of the kernel.randomize_va_space kernel parameter can be queried
by running the following command:
$ sysctl kernel.randomize_va_space
2.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_set_max_life_existing_question:question:1">
          <ocil:question_text>Check whether the maximum time period for existing passwords is restricted to  days with the following commands:

$ sudo awk -F: '$5 &gt; 60 {print $1 " " $5}' /etc/shadow

$ sudo awk -F: '$5 &lt;= 0 {print $1 " " $5}' /etc/shadow
      Is it the case that any results are returned that are not associated with a system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/tmp\s'
    . . . /tmp . . . nosuid . . .

      Is it the case that the "/tmp" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_x11_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:

$ sudo grep -i X11Forwarding /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_priv_separation_question:question:1">
          <ocil:question_text>To check if UsePrivilegeSeparation is enabled or set correctly, run the
following command:
$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config
If configured properly, output should be .
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_at_deny_not_exist_question:question:1">
          <ocil:question_text>The file /etc/at.deny should not exist.
This can be checked by running the following

stat /etc/at.deny

and the output should be

stat: cannot stat `/etc/at.deny': No such file or directory

      Is it the case that the file /etc/at.deny exists?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sudo_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sudo package is installed: $ rpm -q sudo
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
          <ocil:question_text>The runtime status of the kernel.yama.ptrace_scope kernel parameter can be queried
by running the following command:
$ sysctl kernel.yama.ptrace_scope
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.rp_filter
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_max_sessions_question:question:1">
          <ocil:question_text>Run the following command to see what the max sessions number is:
$ sudo grep MaxSessions /etc/ssh/sshd_config
If properly configured, the output should be:
MaxSessions 
      Is it the case that MaxSessions is not configured or not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_crontab_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/crontab,
run the command:
$ ls -lL /etc/crontab
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/crontab does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_shells_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shells,
run the command:
$ ls -lL /etc/shells
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shells does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_weekly_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.weekly,
run the command:
$ ls -lL /etc/cron.weekly
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.weekly does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_randstruct_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_RANDSTRUCT /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_firewire-core_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the firewire-core kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the firewire-core kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rlogin_disabled_question:question:1">
          <ocil:question_text>
To check that the rlogin service is disabled in system boot configuration with xinetd, run the following command:
$ chkconfig rlogin --list
Output should indicate the rlogin service has either not been installed, or has been disabled, as shown in the example below:
$ chkconfig rlogin --list

Note: This output shows SysV services only and does not include native
systemd services. SysV configuration data might be overridden by native
systemd configuration.

If you want to list systemd services use 'systemctl list-unit-files'.
To see services enabled on particular target use
'systemctl list-dependencies [target]'.

rlogin       off

To check that the rlogin socket is disabled in system boot configuration with systemd, run the following command:
$ systemctl is-enabled rlogin
Output should indicate the rlogin socket has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled rlogindisabled

Run the following command to verify rlogin is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active rlogin

If the socket is not running the command will return the following output:
inactive

The socket will also be masked, to check that the rlogin is masked, run the following command:
$ sudo systemctl show rlogin | grep "LoadState\|UnitFileState"

If the socket is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that service and/or socket are running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_proc_kcore_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PROC_KCORE /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/passwd,
run the command:
$ ls -lL /etc/passwd
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/passwd does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_modify_success_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-2-modify-success.rules
The output has to be exactly as follows:
## Successful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-modification    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_dracut_fips_module_question:question:1">
          <ocil:question_text>To verify that the Dracut FIPS module is enabled, run the following command:
grep "add_dracutmodules" /etc/dracut.conf.d/40-fips.conf
The output should look like this:
add_dracutmodules+=" fips "
      Is it the case that the Dracut FIPS module is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_sudoers_question:question:1">
          <ocil:question_text>To check the ownership of /etc/sudoers,
run the command:
$ ls -lL /etc/sudoers
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/sudoers does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_profile_question:question:1">
          <ocil:question_text>Verify the umask setting is configured correctly in the /etc/profile file
or scripts within /etc/profile.d directory with the following command:
$ grep "umask" /etc/profile*
umask 
      Is it the case that the value for the "umask" parameter is not "&lt;sub idref="var_accounts_user_umask" /&gt;",
or the "umask" parameter is missing or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:

$ sudo grep -i X11Forwarding /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_prevent_unrestricted_relay_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to prevent unrestricted mail relaying,
run the following command:
$ sudo postconf -n smtpd_client_restrictions
      Is it the case that the "smtpd_client_restrictions" parameter contains any entries other than "permit_mynetworks" and "reject"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audit_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the audit package is installed: $ rpm -q audit
      Is it the case that the audit package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_min_rounds_logindefs_question:question:1">
          <ocil:question_text>Inspect /etc/login.defs and ensure that if either
SHA_CRYPT_MIN_ROUNDS or SHA_CRYPT_MAX_ROUNDS
are set, they must have the minimum value of .
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-firewalld_loopback_traffic_trusted_question:question:1">
          <ocil:question_text>Inspect the network interfaces assigned to the firewalld trusted zone and verify the
lo interface is listed by running the following command:

$ sudo firewall-cmd --list-interfaces --zone=trusted
      Is it the case that loopback traffic is not trusted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_monthly_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.monthly,
run the command:
$ ls -lL /etc/cron.monthly
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.monthly does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.router_solicitations kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.router_solicitations
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.log_martians
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_hardened_usercopy_fallback_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_HARDENED_USERCOPY_FALLBACK /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_semanage_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "semanage" command with the following command:

$ sudo auditctl -l | grep semanage

-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_custom_logfile_question:question:1">
          <ocil:question_text>To determine if logfile has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults\s*\blogfile\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that logfile is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_users_coredumps_question:question:1">
          <ocil:question_text>Verify that core dumps are disabled for all users, run the following command:
$ grep core /etc/security/limits.conf
*     hard   core    0
      Is it the case that the "core" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement for all domains that have the "core"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_core_uses_pid_question:question:1">
          <ocil:question_text>The runtime status of the kernel.core_uses_pid kernel parameter can be queried
by running the following command:
$ sysctl kernel.core_uses_pid
0.
      Is it the case that the returned line does not have a value of 0?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command:

$  sudo auditctl -l | grep -E '(/etc/passwd)'

-w /etc/passwd -p wa -k identity
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_latent_entropy_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_LATENT_ENTROPY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH client uses defined MACs in the Crypto Policy, run:
$ grep -i macs /etc/crypto-policies/back-ends/openssh.config
and verify that the line matches:
MACs 
      Is it the case that Crypto Policy for OpenSSH client is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_kerberos_enabled_question:question:1">
          <ocil:question_text>
Run the following command to determine if the kerberos_enabled SELinux boolean is enabled:
$ getsebool kerberos_enabled
If properly configured, the output should show the following:
kerberos_enabled --&gt; on
      Is it the case that kerberos_enabled is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd-,
run the command:
$ ls -l /etc/passwd-
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd- does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-xwindows_remove_packages_question:question:1">
          <ocil:question_text>To ensure the X Windows package group is removed, run the following command:

$ rpm -qi xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland

For each package mentioned above you should receive following line:
package &lt;package&gt; is not installed
      Is it the case that xorg related packages are not removed and run level is not correctly configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_seunshare_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_validate_passwd_question:question:1">
          <ocil:question_text>Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
 sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)' 
or if cvtsudoers not supported:
 sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; 
If no results are returned, this is a finding.
If conflicting results are returned, this is a finding.
If "Defaults !targetpw" is not defined, this is a finding.
If "Defaults !rootpw" is not defined, this is a finding.
If "Defaults !runaspw" is not defined, this is a finding.
      Is it the case that invoke user passwd when using sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /dev/shm mount point,
    run the following command:
    $ sudo mount | grep '\s/dev/shm\s'
    . . . /dev/shm . . . nodev . . .

      Is it the case that the "/dev/shm" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_list_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_LIST /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_chrony_keys_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/chrony.keys,
run the command:
$ ls -lL /etc/chrony.keys
If properly configured, the output should indicate the following group-owner:
chrony
      Is it the case that /etc/chrony.keys does not have a group owner of chrony?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_panic_on_oops_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PANIC_ON_OOPS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_modules_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.modules_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.modules_disabled
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_log_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /var/log with the following command:

$ mountpoint /var/log

      Is it the case that "/var/log is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_group_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/group,
run the command:
$ ls -lL /etc/group
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/group does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_no_chronyc_network_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 disables network management of the chrony daemon with the following command:
$ grep -w cmdport /etc/chrony.conf
cmdport 0
      Is it the case that the "cmdport" option is not set to "0", is commented out, or is missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gnutls-utils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the gnutls-utils package is installed: $ rpm -q gnutls-utils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_debug-shell_disabled_question:question:1">
          <ocil:question_text>To check that the debug-shell service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled debug-shell
Output should indicate the debug-shell service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled debug-shell disabled

Run the following command to verify debug-shell is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active debug-shell

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the debug-shell is masked, run the following command:
$ sudo systemctl show debug-shell | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "debug-shell" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_macs_opensshserver_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH server uses defined MACs in the Crypto Policy, run:
$ grep -Po '(-oMACs=\S+)' /etc/crypto-policies/back-ends/opensshserver.config
and verify that the line matches:
-oMACS=
      Is it the case that Crypto Policy for OpenSSH Server is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_pinfo kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_pinfo
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_randomize_memory_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_RANDOMIZE_MEMORY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_ipv6_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_IPV6 /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_umount_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 generates an audit record for all uses of the "umount" and system call.
To determine if the system is configured to audit calls to the
"umount" system call, run the following command:
$ sudo grep "umount" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line like the following.
-a always,exit -F arch=b32 -S umount -F auid&gt;=1000 -F auid!=unset -k privileged-umount
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_syslogng_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
syslog-ng service:
$ sudo systemctl is-active syslog-ng
If the service is running, it should return the following: active
      Is it the case that the "syslog-ng" service is disabled, masked, or not started.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_selinuxuser_execheap_question:question:1">
          <ocil:question_text>
Run the following command to determine if the selinuxuser_execheap SELinux boolean is disabled:
$ getsebool selinuxuser_execheap
If properly configured, the output should show the following:
selinuxuser_execheap --&gt; off
      Is it the case that selinuxuser_execheap is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_libreswan_crypto_policy_question:question:1">
          <ocil:question_text>Verify that the IPSec service uses the system crypto policy.

If the ipsec service is not installed is not applicable.

Check to see if the "IPsec" service is active with the following command:

$ systemctl status ipsec

ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)
Active: inactive (dead)

If the "IPsec" service is active, check to see if it is using the system crypto policy with the following command:

$ sudo grep include /etc/ipsec.conf /etc/ipsec.d/*.conf

/etc/ipsec.conf:include /etc/crypto-policies/back-ends/libreswan.config
      Is it the case that the "IPsec" service is active and the ipsec configuration file does not contain does not contain &lt;tt&gt;include /etc/crypto-policies/back-ends/libreswan.config&lt;/tt&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_selinuxuser_execmod_question:question:1">
          <ocil:question_text>
Run the following command to determine if the selinuxuser_execmod SELinux boolean is enabled:
$ getsebool selinuxuser_execmod
If properly configured, the output should show the following:
selinuxuser_execmod --&gt; on
      Is it the case that selinuxuser_execmod is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/gshadow-,
run the command:
$ ls -lL /etc/gshadow-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/gshadow- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_cramfs_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the cramfs kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the cramfs kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r cramfs /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_chsh_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "chsh" command with the following command:

$ sudo auditctl -l | grep chsh

-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-chsh
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_groupowner_etc_iptables_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/iptables,
run the command:
$ ls -lL /etc/iptables
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/iptables does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_pcsc-lite_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the pcsc-lite package is installed: $ rpm -q pcsc-lite
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
          <ocil:question_text>To check for incorrectly labeled device files, run following commands:
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_structleak_byref_all_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_finit_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
finit_module system call, run the following command:
$ sudo grep "finit_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-display_login_attempts_question:question:1">
          <ocil:question_text>Verify users are provided with feedback on when account accesses last occurred with the following command:

$ sudo grep pam_lastlog /etc/pam.d/postlogin

session required pam_lastlog.so showfailed
      Is it the case that "pam_lastlog.so" is not properly configured in "/etc/pam.d/postlogin" file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_configure_name_resolution_question:question:1">
          <ocil:question_text>Verify that DNS servers have been configured properly, perform the following:
$ sudo grep nameserver /etc/resolv.conf
      Is it the case that less than two lines are returned that are not commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_mds_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes mds=,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*mds=.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*mds=.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'mds='
The command should not return any output.
      Is it the case that MDS mitigations are not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_aide_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the aide package is installed: $ rpm -q aide
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rear_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rear package is installed: $ rpm -q rear
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /home mount point,
    run the following command:
    $ sudo mount | grep '\s/home\s'
    . . . /home . . . noexec . . .

      Is it the case that the "/home" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_messages_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log/messages,
run the command:
$ ls -lL /var/log/messages
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /var/log/messages does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_firewalld_default_zone_question:question:1">
          <ocil:question_text>Inspect the file /etc/firewalld/firewalld.conf to determine
the default zone for the firewalld. It should be set to DefaultZone=drop:
$ sudo grep DefaultZone /etc/firewalld/firewalld.conf
      Is it the case that the default zone is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
          <ocil:question_text>Verify that only the "root" account has a UID "0" assignment with the
following command:
$ awk -F: '$3 == 0 {print $1}' /etc/passwd
root
      Is it the case that any accounts other than "root" have a UID of "0"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_binary_dirs_question:question:1">
          <ocil:question_text>Verify the system commands contained in the following directories have mode "755" or less permissive with the following command:

$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin -perm /022 -exec ls -l {} \;
      Is it the case that any system commands are found to be group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "userhelper" command with the following command:

$ sudo auditctl -l | grep userhelper

-a always,exit -F path=/usr/bin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-userhelper
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_syslogng_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the syslog-ng-core package is installed: $ rpm -q syslog-ng-core
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "gpasswd" command with the following command:

$ sudo auditctl -l | grep gpasswd

-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-gpasswd
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlink system call, run the following command:
$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
rename system call, run the following command:
$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
renameat system call, run the following command:
$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_user_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/grub2/user.cfg,
run the command:
$ ls -lL /boot/grub2/user.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/grub2/user.cfg does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_user_max_user_namespaces_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 disables the use of user namespaces with the following commands:

Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable.

The runtime status of the user.max_user_namespaces kernel parameter can be queried
by running the following command:
$ sysctl user.max_user_namespaces
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dnf-automatic_apply_updates_question:question:1">
          <ocil:question_text>To verify that packages comprising the available updates will be automatically installed by dnf-automatic, run the following command:
$ sudo grep apply_updates /etc/dnf/automatic.conf
The output should return the following:
apply_updates = yes
      Is it the case that apply_updates is not set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to notify the SA and/or ISSO (at a minimum) in the event of an audit processing failure with the following command:

$ sudo grep action_mail_acct /etc/audit/auditd.conf

action_mail_acct = 
      Is it the case that the value of the "action_mail_acct" keyword is not set to "&lt;sub idref="var_auditd_action_mail_acct" /&gt;" and/or other accounts for security personnel, the "action_mail_acct" keyword is missing, or the retuned line is commented out, ask the system administrator to indicate how they and the ISSO are notified of an audit process failure. If there is no evidence of the proper personnel being notified of an audit processing failure?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-agent_mfetpd_running_question:question:1">
          <ocil:question_text>To verify that McAfee Endpoint Security for Linux is
running, run the following command:
$ sudo ps -ef | grep -i mfetpd
      Is it the case that virus scanning software is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_ptys_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_PTYS /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rename system call, run the following command:
$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nosuid_removable_partitions_question:question:1">
          <ocil:question_text>Verify file systems that are used for removable media are mounted with the "nosuid" option with the following command:

$ sudo more /etc/fstab

UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0
      Is it the case that file system found in "/etc/fstab" refers to removable media and it does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_media_export_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
mount system call, run the following command:
$ sudo grep "mount" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_hourly_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.hourly,
run the command:
$ ls -lL /etc/cron.hourly
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.hourly does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_efi_user_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/user.cfg,
run the command:
$ ls -l /boot/grub2/user.cfg
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /boot/grub2/user.cfg does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "passwd" command with the following command:

$ sudo auditctl -l | grep passwd

-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-passwd
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_shared_media_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.shared_media kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.shared_media
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_state_question:question:1">
          <ocil:question_text>Ensure that Oracle Linux 9 verifies correct operation of security functions.

Check if "SELinux" is active and in "" mode with the following command:

$ sudo getenforce

      Is it the case that SELINUX is not set to enforcing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 use the "pam_pwhistory.so" module in the /etc/pam.d/system-auth file
and is configured to prohibit password reuse for a minimum of 
generations.

Verify the "/etc/pam.d/system-auth" file with the following command:

$ grep pam_pwhistory.so /etc/pam.d/system-auth
password  pam_pwhistory.so use_authtok remember=


Verify the "/etc/security/pwhistory.conf" file using the following command:

$ grep remember /etc/security/pwhistory.conf
remember = 

The pam_pwhistory.so "remember" option must be configured only in one file.
      Is it the case that the pam_pwhistory.so module is not used, the "remember" module option is not set in
/etc/pam.d/system-auth or in /etc/security/pwhistory.conf, or is set in both files, or is set
with a value less than "&lt;sub idref="var_password_pam_remember" /&gt;"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_usbguard_auditbackend_question:question:1">
          <ocil:question_text>To verify that Linux Audit logging is enabled for the USBGuard daemon,
run the following command:
$ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf
The output should be
AuditBackend=LinuxAudit
      Is it the case that AuditBackend is not set to LinuxAudit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_cron_monthly_question:question:1">
          <ocil:question_text>To check the permissions of /etc/cron.monthly,
run the command:
$ ls -l /etc/cron.monthly
If properly configured, the output should indicate the following permissions:
-rwx------
      Is it the case that /etc/cron.monthly does not have unix mode -rwx------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_compat_vdso_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_COMPAT_VDSO /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-firewalld-backend_question:question:1">
          <ocil:question_text>Verify "nftables" is configured to allow rate limits on any connection to the system with the following command:

Verify "firewalld" has "nftables" set as the default backend:

$ sudo grep -i firewallbackend /etc/firewalld/firewalld.conf

# FirewallBackend
FirewallBackend=nftables
      Is it the case that the "nftables" is not set as the "firewallbackend"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_issue_net_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/issue.net,
run the command:
$ ls -lL /etc/issue.net
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/issue.net does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-systemd_tmp_mount_enabled_question:question:1">
          <ocil:question_text>
Run the following command to determine the current status of the
tmp mount:
$ sudo systemctl is-active tmp.mount
If the mount unit is running, it should return the following: active
      Is it the case that the tmp.mount unit is masked or disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_efi_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /boot/efi mount point,
    run the following command:
    $ sudo mount | grep '\s/boot/efi\s'
    . . . /boot/efi . . . nosuid . . .

      Is it the case that the "/boot/efi" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_groupowner_etc_selinux_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/selinux,
run the command:
$ ls -lL /etc/selinux
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/selinux does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_policytype_question:question:1">
          <ocil:question_text>Verify the SELINUX on Oracle Linux 9 is using the  policy with the following command:

$ sestatus | grep policy

Loaded policy name:             
      Is it the case that the loaded policy name is not "&lt;sub idref="var_selinux_policy_name" /&gt;"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_vsyscall_none_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_VSYSCALL_NONE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_nftables_disabled_question:question:1">
          <ocil:question_text>To check that the nftables service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled nftables
Output should indicate the nftables service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled nftables disabled

Run the following command to verify nftables is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active nftables

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the nftables is masked, run the following command:
$ sudo systemctl show nftables | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "nftables" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_passwd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/passwd,
run the command:
$ ls -lL /etc/passwd
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/passwd does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_immutable_login_uids_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
$ sudo cat /etc/audit/rules.d/11-loginuid.rules
The output has to be exactly as follows:
## Make the loginuid immutable. This prevents tampering with the auid.
--loginuid-immutable    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gid_passwd_group_same_question:question:1">
          <ocil:question_text>To ensure all GIDs referenced in /etc/passwd are defined in /etc/group,
run the following command:
$ sudo pwck -qr
There should be no output.
      Is it the case that GIDs referenced in /etc/passwd are returned as not defined in /etc/group?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_logrotate_activated_question:question:1">
          <ocil:question_text>To determine the status and frequency of logrotate, run the following command:
$ sudo grep logrotate /var/log/cron*
If logrotate is configured properly, output should include references to
/etc/cron.daily.
      Is it the case that logrotate is not configured to run daily?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_setroubleshoot-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the setroubleshoot-server package is installed:
$ rpm -q setroubleshoot-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /var/log/audit mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log/audit\s'
    . . . /var/log/audit . . . nodev . . .

      Is it the case that the "/var/log/audit" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
          <ocil:question_text>To verify the INACTIVE setting, run the following command:
$ grep "INACTIVE" /etc/default/useradd
The output should indicate the INACTIVE configuration option is set
to an appropriate integer as shown in the example below:
$ grep "INACTIVE" /etc/default/useradd
INACTIVE=
      Is it the case that the value of INACTIVE is greater than the expected value or is -1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "ssh-keysign" command with the following command:

$ sudo auditctl -l | grep ssh-keysign

-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-ssh-keysign
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_audit_tools_permissions_question:question:1">
          <ocil:question_text>Verify the audit tools are protected from unauthorized access, deletion, or modification by checking the permissive mode.

Check the octal permission of each audit tool by running the following command:

$ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules
      Is it the case that any of these files have more permissive permissions than 0755?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_ipsec_conf_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/ipsec.conf,
run the command:
$ ls -lL /etc/ipsec.conf
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/ipsec.conf does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_sudo_log_events_question:question:1">
          <ocil:question_text>Verify the operating system audits activities performed during nonlocal
maintenance and diagnostic sessions. Run the following command:
$ sudo auditctl -l | grep sudo.log
-w /var/log/sudo.log -p wa -k maintenance

      Is it the case that Audit rule is not present?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_writable_hooks_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY_WRITABLE_HOOKS /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-use_pam_wheel_for_su_question:question:1">
          <ocil:question_text>Run the following command to check if the line is present:
grep pam_wheel /etc/pam.d/su
The output should contain the following line:
auth required pam_wheel.so use_uid
      Is it the case that the line is not in the file or it is commented?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_kdump_disabled_question:question:1">
          <ocil:question_text>To check that the kdump service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled kdump
Output should indicate the kdump service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled kdump disabled

Run the following command to verify kdump is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active kdump

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the kdump is masked, run the following command:
$ sudo systemctl show kdump | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "kdump" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_rtr_pref kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_rtr_pref
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_autorun_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling autorun-never
If properly configured, the output for autorun-nevershould be true.
To ensure that users cannot enable autorun in GNOME3, run the following:
$ grep 'autorun-never' /etc/dconf/db/local.d/locks/*
If properly configured, the output for autorun-never should be /org/gnome/desktop/media-handling/autorun-never
      Is it the case that GNOME autorun is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_loghost_question:question:1">
          <ocil:question_text>To ensure logs are sent to a remote host, examine the file
/etc/rsyslog.conf.
If using UDP, a line similar to the following should be present:
 *.* @
If using TCP, a line similar to the following should be present:
 *.* @@
If using RELP, a line similar to the following should be present:
 *.* :omrelp:
      Is it the case that no evidence that the audit logs are being off-loaded to another system or media?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
          <ocil:question_text>To find SUID files, run the following command:
$ sudo find / -xdev -type f -perm -4000
      Is it the case that only authorized files appear in the output of the find command?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_syslog_question:question:1">
          <ocil:question_text>To check the ownership of /var/log/syslog,
run the command:
$ ls -lL /var/log/syslog
If properly configured, the output should indicate the following owner:
syslog
      Is it the case that /var/log/syslog does not have an owner of syslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/gshadow,
run the command:
$ ls -lL /etc/gshadow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/gshadow does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_empty_passwords_question:question:1">
          <ocil:question_text>To verify that null passwords cannot be used, run the following command:

$ grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth

If this produces any output, it may be possible to log into accounts
with empty passwords. Remove any instances of the nullok option to
prevent logins with empty passwords.
      Is it the case that NULL passwords can be used?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_privileged_commands_reboot_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "reboot" command with the following command:

$ sudo auditctl -l | grep reboot

-a always,exit -F path=/reboot -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-reboot
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_syslog_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log/syslog,
run the command:
$ ls -lL /var/log/syslog
If properly configured, the output should indicate the following group-owner:
adm
      Is it the case that /var/log/syslog does not have a group owner of adm?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permission_user_init_files_question:question:1">
          <ocil:question_text>To verify that all user initialization files have a mode of 0740 or
less permissive, run the following command:
$ sudo find /home -type f -name '\.*' \( -perm -0002 -o -perm -0020 \)
There should be no output.
      Is it the case that they are not 0740 or more permissive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
clock_settime system call, run the following command:
$ sudo grep "clock_settime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_slab_nomerge_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes slab_nomerge=yes,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*slab_nomerge=yes.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*slab_nomerge=yes.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'slab_nomerge=yes'
The command should not return any output.
      Is it the case that merging of slabs with similar size is enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH client uses defined Cipher suite in the Crypto Policy, run:
$ grep -i ciphers /etc/crypto-policies/back-ends/openssh.config
and verify that the line matches:
Ciphers 
      Is it the case that Crypto Policy for OpenSSH client is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_password_question:question:1">
          <ocil:question_text>First, check whether the password is defined in either /boot/grub2/user.cfg or
/boot/grub2/grub.cfg.
Run the following commands:
$ sudo grep '^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$' /boot/grub2/user.cfg
$ sudo grep '^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$' /boot/grub2/grub.cfg


Second, check that a superuser is defined in /boot/grub2/grub.cfg.
$ sudo grep '^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$'  /boot/grub2/grub.cfg
      Is it the case that it does not produce any output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_syslog_question:question:1">
          <ocil:question_text>To check the permissions of /var/log/syslog,
run the command:
$ ls -l /var/log/syslog
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /var/log/syslog does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_allow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.allow,
run the command:
$ ls -lL /etc/cron.allow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.allow does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dnf-automatic_security_updates_only_question:question:1">
          <ocil:question_text>To verify that only security updates will be automatically installed by dnf-automatic, run the following command:
$ sudo grep upgrade_type /etc/dnf/automatic.conf
The output should return the following:
upgrade_type = security
      Is it the case that the upgrade_type is not set to security?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_core_bpf_jit_harden_question:question:1">
          <ocil:question_text>The runtime status of the net.core.bpf_jit_harden kernel parameter can be queried
by running the following command:
$ sysctl net.core.bpf_jit_harden
2.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_idle_timeout_question:question:1">
          <ocil:question_text>Run the following command to see what the timeout interval is:
$ sudo grep ClientAliveInterval /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveInterval 
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/passwd-,
run the command:
$ ls -lL /etc/passwd-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/passwd- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_permissions_question:question:1">
          <ocil:question_text>The file permissions for all log files written by rsyslog should
be set to 640, or more restrictive. These log files are determined by the
second part of each Rule line in /etc/rsyslog.conf and typically
all appear in /var/log. To see the permissions of a given log
file, run the following command:
$ ls -l LOGFILE
The permissions should be 640, or more restrictive.
      Is it the case that the permissions are not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_csh_cshrc_question:question:1">
          <ocil:question_text>Verify the "umask" setting is configured correctly in the "/etc/csh.cshrc" file with the following command:

$ grep umask /etc/csh.cshrc

umask 077
umask 077
      Is it the case that the value for the "umask" parameter is not "&lt;sub idref="var_accounts_user_umask" /&gt;", or the "umask" parameter is missing or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_binfmt_misc_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_BINFMT_MISC /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_polyinstantiated_tmp_question:question:1">
          <ocil:question_text>Run the following command to ensure that /tmp is configured as a
polyinstantiated directory:
$ sudo grep /tmp /etc/security/namespace.conf
The output should return the following:
/tmp     /tmp/tmp-inst/            level      root,adm
      Is it the case that is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_ipsec_secrets_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/ipsec.secrets,
run the command:
$ ls -lL /etc/ipsec.secrets
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/ipsec.secrets does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_system_shutdown_question:question:1">
          <ocil:question_text>To verify that the system will shutdown when auditd fails,
run the following command:
$ sudo grep "\-f " /etc/audit/audit.rules
The output should contain:
-f 
      Is it the case that the system is not configured to shutdown on auditd failures?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_strict_kernel_rwx_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STRICT_KERNEL_WRX /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_retpoline_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_RETPOLINE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_passwordauth_question:question:1">
          <ocil:question_text>Inspect the password section of /etc/pam.d/password-auth
and ensure that the pam_unix.so module is configured to use the argument
:

$ grep  /etc/pam.d/password-auth
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library files are owned by "root" with the following command:

$ sudo find -L /lib /lib64 /usr/lib /usr/lib64 ! -user root -exec ls -l {} \;
      Is it the case that any system wide shared library file is not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_smartcards_question:question:1">
          <ocil:question_text>To verify that smart cards are enabled in SSSD, run the following command:
$ sudo grep pam_cert_auth /etc/sssd/sssd.conf
If configured properly, output should be
pam_cert_auth = True


To verify that smart cards are enabled in PAM files, run the following command:
$ sudo grep -e "auth.*pam_sss\.so.*\(allow_missing_name\|try_cert_auth\)" /etc/pam.d/smartcard-auth /etc/pam.d/system-auth
If configured properly, output should be

/etc/pam.d/smartcard-auth:auth        sufficient                                   pam_sss.so allow_missing_name
/etc/pam.d/system-auth:auth        [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth

      Is it the case that smart cards are not enabled in SSSD?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ufw_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
ufw service:
$ sudo systemctl is-active ufw
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_audit_question:question:1">
          <ocil:question_text>Run the following command to check the mode of the system audit logs:
$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file=/var/log/audit/audit.log
$ sudo stat -c "%n %a" /var/log/audit/*
$ sudo ls -l /var/log/audit
Audit logs must be mode 0640 or less permissive.
      Is it the case that any permissions are more permissive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_tmp_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /var/tmp with the following command:

$ mountpoint /var/tmp

      Is it the case that "/var/tmp is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_pam_timestamp_check_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "pam_timestamp_check" command with the following command:

$ sudo auditctl -l | grep pam_timestamp_check

-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-pam_timestamp_check
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-firewalld_sshd_port_enabled_question:question:1">
          <ocil:question_text>


To determine if firewalld is configured to allow access

on port 22/tcp, run the following command(s):
    firewall-cmd --list-ports


to ssh
    firewall-cmd --list-services

If firewalld is configured to allow access through the firewall, something similar to the following will be output:

If it is a service:
ssh


If it is a port:
22/tcp

      Is it the case that sshd service is not enabled in the proper firewalld zone?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
          <ocil:question_text>To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_ignore_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.arp_ignore kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.arp_ignore
.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_log_format_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to resolve all uid, gid, syscall,
architecture, and socket address information before writing the event to disk,
run the following command:
$ sudo grep log_format /etc/audit/auditd.conf
The output should return the following:
log_format = ENRICHED
      Is it the case that log_format isn't set to ENRICHED?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
          <ocil:question_text>To check that the screen locks immediately when activated, run the following command:
$ gsettings get org.gnome.desktop.screensaver lock-delay
If properly configured, the output should be 'uint32 '.
      Is it the case that the screensaver lock delay is missing, or is set to a value greater than &lt;sub idref="var_screensaver_lock_delay" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
          <ocil:question_text>The runtime status of the kernel.dmesg_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.dmesg_restrict
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces password complexity by requiring that at least one upper-case character.

Check the value for "ucredit" with the following command:

$ sudo grep ucredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

ucredit = -1
      Is it the case that the value of "ucredit" is a positive number or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_log_audit_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /var/log/audit with the following command:

$ mountpoint /var/log/audit

      Is it the case that "/var/log/audit is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_hardlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_hardlinks
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
          <ocil:question_text>Verify that yum verifies the signature of local packages prior to install with the following command:

$ grep localpkg_gpgcheck /etc/yum.conf

localpkg_gpgcheck=1

If "localpkg_gpgcheck" is not set to "1", or if the option is missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.
      Is it the case that there is no process to validate certificates for local packages that is approved by the organization?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_usbguard_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
usbguard service:
$ sudo systemctl is-active usbguard
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_mac_modification_usr_share_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
$ sudo auditctl -l | grep "dir=/usr/share/selinux"
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
perm=wa indicating permissions that are watched).
      Is it the case that the system is not configured to audit attempts to change the MAC policy?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
          <ocil:question_text>
Check if SSSD allows cached authentications with the following command:

$ sudo grep cache_credentials /etc/sssd/sssd.conf
cache_credentials = true

If "cache_credentials" is set to "false" or is missing no further checks are required.

To verify that SSSD expires offline credentials, run the following command:
$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf
If configured properly, output should be
offline_credentials_expiration = 1
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_question:question:1">
          <ocil:question_text>To verify the number of rounds for the password hashing algorithm is configured, run the following command:
$ sudo grep rounds /etc/pam.d/system-auth
The output should show the following match:
password sufficient pam_unix.so sha512 rounds=
      Is it the case that rounds is not set to &lt;sub idref="var_password_pam_unix_rounds" /&gt; or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_credentials_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_CREDENTIALS /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_ownership_question:question:1">
          <ocil:question_text>The following command will list which files on the system have ownership different from what
is expected by the RPM database:
$ rpm -Va | rpm -Va --nofiledigest | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_snmpd_disabled_question:question:1">
          <ocil:question_text>To check that the snmpd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled snmpd
Output should indicate the snmpd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled snmpd disabled

Run the following command to verify snmpd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active snmpd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the snmpd is masked, run the following command:
$ sudo systemctl show snmpd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "snmpd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_hashes_question:question:1">
          <ocil:question_text>The following command will list which files on the system have file hashes different from what
is expected by the RPM database.
$ rpm -Va --noconfig | awk '$1 ~ /..5/'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_sshd_config_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/ssh/sshd_config,
run the command:
$ ls -lL /etc/ssh/sshd_config
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/ssh/sshd_config does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_crypto-policies_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the crypto-policies package is installed: $ rpm -q crypto-policies
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_nosmep_argument_absent_question:question:1">
          <ocil:question_text>Make sure that the kernel is not disabling SMEP with the following
commands.
grep -q nosmep /boot/config-`uname -r`
If the command returns a line, it means that SMEP is being disabled.
      Is it the case that the kernel is configured to disable SMEP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audispd-plugins_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the audispd-plugins package is installed: $ rpm -q audispd-plugins
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_slub_debug_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes slub_debug=,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*slub_debug=.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*slub_debug=.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'slub_debug='
The command should not return any output.
      Is it the case that SLUB/SLAB poisoning is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shadow-,
run the command:
$ ls -lL /etc/shadow-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shadow- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_question:question:1">
          <ocil:question_text>Verify the operating system encrypts audit records off-loaded onto a different system
or media from the system being audited with the following commands:

$ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf

The output should be:

/etc/rsyslog.conf:$ActionSendStreamDriverMode 1
      Is it the case that rsyslogd ActionSendStreamDriverMode is not set to 1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_vmap_stack_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_VMAP_STACK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log,
run the command:
$ ls -lL /var/log
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /var/log does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH Client uses defined Crypto Policy, run:
$ cat /etc/ssh/ssh_config.d/02-ospp.conf
and verify that the line matches
Match final all
RekeyLimit 512M 1h
GSSAPIAuthentication no
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
MACs hmac-sha2-512,hmac-sha2-256
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1
      Is it the case that Crypto Policy for OpenSSH Client is not configured according to CC requirements?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/gshadow-,
run the command:
$ ls -l /etc/gshadow-
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow- does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_all_squash_exports_question:question:1">
          <ocil:question_text>To verify all squashing has been disabled, run the following command:
$ grep all_squash /etc/exports
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_password_pam_faillock_system_auth_question:question:1">
          <ocil:question_text>Verify the pam_faillock.so module is present in the "/etc/pam.d/system-auth" file:

$ sudo grep pam_faillock.so /etc/pam.d/system-auth

auth required pam_faillock.so preauth
auth required pam_faillock.so authfail
account required pam_faillock.so
      Is it the case that the pam_faillock.so module is not present in the "/etc/pam.d/system-auth" file with the "preauth" line listed before pam_unix.so?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's GSSAPIAuthentication option is set, run the following command:

$ sudo grep -i GSSAPIAuthentication /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_syn_cookies_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SYN_COOKIES /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_group_question:question:1">
          <ocil:question_text>To check the ownership of /etc/group-,
run the command:
$ ls -lL /etc/group-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/group- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_name_format_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to record the computer node
name in the audit events, run the following command:
$ sudo grep name_format /etc/audit/auditd.conf
The output should return the following:
name_format = 
      Is it the case that name_format isn't set to &lt;sub idref="var_auditd_name_format" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_telnet_disabled_question:question:1">
          <ocil:question_text>
To check that the telnet service is disabled in system boot configuration with xinetd, run the following command:
$ chkconfig telnet --list
Output should indicate the telnet service has either not been installed, or has been disabled, as shown in the example below:
$ chkconfig telnet --list

Note: This output shows SysV services only and does not include native
systemd services. SysV configuration data might be overridden by native
systemd configuration.

If you want to list systemd services use 'systemctl list-unit-files'.
To see services enabled on particular target use
'systemctl list-dependencies [target]'.

telnet       off

To check that the telnet socket is disabled in system boot configuration with systemd, run the following command:
$ systemctl is-enabled telnet
Output should indicate the telnet socket has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled telnetdisabled

Run the following command to verify telnet is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active telnet

If the socket is not running the command will return the following output:
inactive

The socket will also be masked, to check that the telnet is masked, run the following command:
$ sudo systemctl show telnet | grep "LoadState\|UnitFileState"

If the socket is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that service and/or socket are running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_etc_selinux_question:question:1">
          <ocil:question_text>To check the permissions of /etc/selinux,
run the command:
$ ls -l /etc/selinux
If properly configured, the output should indicate the following permissions:
0755
      Is it the case that /etc/selinux does not have unix mode 0755?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_event_paranoid_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_event_paranoid kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_event_paranoid
2.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_warning_banner_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's Banner option is set, run the following command:

$ sudo grep -i Banner /etc/ssh/sshd_config

If a line indicating /etc/issue is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_audit_tools_ownership_question:question:1">
          <ocil:question_text>Verify the audit tools are owned by "root" to prevent any unauthorized access, deletion, or modification.

Check the owner of each audit tool by running the following command:

$ sudo stat -c "%U %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules

root /sbin/auditctl
root /sbin/aureport
root /sbin/ausearch
root /sbin/autrace
root /sbin/auditd
root /sbin/rsyslogd
root /sbin/augenrules
      Is it the case that any audit tools are not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlink system call, run the following command:
$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-logind_session_timeout_question:question:1">
          <ocil:question_text>Display the contents of the file /etc/systemd/logind.conf:
cat /etc/systemd/logind.conf
Ensure that there is a section [login] which contains the
configuration StopIdleSessionSec=.
      Is it the case that the option is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_error_action_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 takes the appropriate action when an audit processing failure occurs.

Check that Oracle Linux 9 takes the appropriate action when an audit processing failure occurs with the following command:

$ sudo grep disk_error_action /etc/audit/auditd.conf

disk_error_action = 

If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit process failure occurs.
      Is it the case that there is no evidence of appropriate action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_question:question:1">
          <ocil:question_text>To ensure screen locking on smartcard removal is enabled, run the following command:
$ grep removal-action /etc/dconf/db/local.d/*
The output should be 'lock-screen'.
To ensure that users cannot disable screen locking on smartcard removal, run the following:
$ grep removal-action /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/settings-daemon/peripherals/smartcard/removal-action
      Is it the case that removal-action has not been configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_mac_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
$ sudo auditctl -l | grep "dir=/etc/selinux"
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
perm=wa indicating permissions that are watched).
      Is it the case that the system is not configured to audit attempts to change the MAC policy?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_ipsec_secrets_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ipsec.secrets,
run the command:
$ ls -l /etc/ipsec.secrets
If properly configured, the output should indicate the following permissions:
0644
      Is it the case that /etc/ipsec.secrets does not have unix mode 0644?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_root_login_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:

$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_sshd_pub_key_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/ssh/*.pub,
run the command:
$ ls -lL /etc/ssh/*.pub
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/ssh/*.pub does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_access_failed_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
The output has to be exactly as follows:
## Unsuccessful file access (any other opens) This has to go last.
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-access    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /var mount point,
    run the following command:
    $ sudo mount | grep '\s/var\s'
    . . . /var . . . noexec . . .

      Is it the case that the "/var" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_telnet_removed_question:question:1">
          <ocil:question_text>The telnet package can be removed with the following command:  $ sudo yum erase telnet
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's LogLevel option is set, run the following command:

$ sudo grep -i LogLevel /etc/ssh/sshd_config

If a line indicating VERBOSE is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.router_solicitations kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.router_solicitations
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_strict_module_rwx_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STRICT_MODULE_RWX /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_set_max_life_root_question:question:1">
          <ocil:question_text>Check whether the maximum time period for root account password is restricted to  days with the following commands:

$ sudo awk -F: '$1 == "root" {print $1 " " $5}' /etc/shadow
      Is it the case that any results are returned that are not associated with a system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_defrtr kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_defrtr
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_tcp_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's AllowTcpForwarding option is set, run the following command:

$ sudo grep -i AllowTcpForwarding /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.
      Is it the case that The AllowTcpForwarding option exists and is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_sshd_private_key_question:question:1">
          <ocil:question_text>To check the ownership of /etc/ssh/*_key,
run the command:
$ ls -lL /etc/ssh/*_key
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/ssh/*_key does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_has_trust_anchor_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 for PKI-based authentication has valid certificates by constructing a
certification path (which includes status information) to an accepted trust anchor.

Check that the system has a valid DoD root CA installed with the following command:

$ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DoD, OU = PKI, CN = DoD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DoD, OU = PKI, CN = DoD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
      Is it the case that root CA file is not a DoD-issued certificate with a valid date and installed in the /etc/sssd/pki/sssd_auth_ca_db.pem location?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
          <ocil:question_text>Verify the value of the "maxrepeat" option in "/etc/security/pwquality.conf" with the following command:

$ grep maxrepeat /etc/security/pwquality.conf

maxrepeat = 
      Is it the case that the value of "maxrepeat" is set to more than "&lt;sub idref="var_password_pam_maxrepeat" /&gt;" or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_use_pty_question:question:1">
          <ocil:question_text>To determine if use_pty has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\buse_pty\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that use_pty is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_secure_mode_insmod_question:question:1">
          <ocil:question_text>
Run the following command to get the current configured value for secure_mode_insmod
SELinux boolean:
$ getsebool secure_mode_insmod
The expected cofiguration is .
"on" means true, and "off" means false
      Is it the case that secure_mode_insmod is not set as expected?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_module_load_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/43-module-load.rules
The output has to be exactly as follows:
## These rules watch for kernel module insertion. By monitoring
## the syscall, we do not need any watches on programs.
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/*_key,
run the command:
$ ls -l /etc/ssh/*_key
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /etc/ssh/*_key does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
          <ocil:question_text>Find the list of alias maps used by the Postfix mail server:
$ sudo postconf alias_maps
Query the Postfix alias maps for an alias for the root user:
$ sudo postmap -q root hash:/etc/aliases
The output should return an alias.
      Is it the case that the alias is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_d_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.d,
run the command:
$ ls -lL /etc/cron.d
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.d does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
          <ocil:question_text>Verify that the system is integrated with a centralized authentication mechanism
such as as Active Directory, Kerberos, Directory Server, etc. that has
automated account mechanisms in place.
      Is it the case that the system is not using a centralized authentication mechanism, or it is not automated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_cron_allow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/cron.allow,
run the command:
$ ls -l /etc/cron.allow
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/cron.allow does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_no_root_target_question:question:1">
          <ocil:question_text>To determine if the users are allowed to run commands as root, run the following commands:
$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]' /etc/sudoers /etc/sudoers.d/
and
$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)' /etc/sudoers /etc/sudoers.d/
Both commands should return no output.
      Is it the case that /etc/sudoers file contains rules that allow non-root users to run commands as root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_full_action_stig_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 takes the appropriate action when the audit storage volume is full.

Check that Oracle Linux 9 takes the appropriate action when the audit storage volume is full with the following command:

$ sudo grep disk_full_action /etc/audit/auditd.conf

disk_full_action = 

If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full.
      Is it the case that there is no evidence of appropriate action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_source_route
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "mount" command with the following command:

$ sudo auditctl -l | grep mount

-a always,exit -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-mount
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_policycoreutils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the policycoreutils package is installed: $ rpm -q policycoreutils
      Is it the case that the policycoreutils package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-prefer_64bit_os_question:question:1">
          <ocil:question_text>To check if the installed Operating System is 64-bit, run the following command:
$ uname -m
The output should be one of the following: x86_64, aarch64, ppc64le or s390x.
If the output is i686 or i386 the operating system is 32-bit.
Check if the installed CPU supports 64-bit operating systems by running the following command:
$ lscpu | grep "CPU op-mode"
If the output contains 64bit, the CPU supports 64-bit operating systems.
      Is it the case that the installed operating sytem is 32-bit but the CPU supports operation in 64-bit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_scan_notification_question:question:1">
          <ocil:question_text>To determine that periodic AIDE execution has been scheduled, run the following command:

$ grep aide /etc/crontab
The output should return something similar to the following:
05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
The email address that the notifications are sent to can be changed by overriding
.
      Is it the case that AIDE has not been configured or has not been configured to notify personnel of scan details?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_issue_net_question:question:1">
          <ocil:question_text>To check if the system login banner is compliant, run the following command:
$ cat /etc/issue.net
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_question:question:1">
          <ocil:question_text>Find the list of alias maps used by the Postfix mail server:
$ sudo postconf alias_maps
Query the Postfix alias maps for an alias for the postmaster user:
$ sudo postmap -q postmaster hash:/etc/aliases
The output should return root.
      Is it the case that the alias is not set or is not root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_chrony_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the chrony package is installed: $ rpm -q chrony
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_pid_max_question:question:1">
          <ocil:question_text>The runtime status of the kernel.pid_max kernel parameter can be queried
by running the following command:
$ sysctl kernel.pid_max
65536.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_question:question:1">
          <ocil:question_text>To check the permissions of /var/log,
run the command:
$ ls -l /var/log
If properly configured, the output should indicate the following permissions:
drwxr-xr-x
      Is it the case that /var/log does not have unix mode drwxr-xr-x?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_stackleak_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_STACKLEAK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_fips_mode_question:question:1">
          <ocil:question_text>To verify that FIPS mode is enabled properly, run the following command:
cat /proc/sys/crypto/fips_enabled
The output be must:
1
      Is it the case that FIPS mode is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_empty_passwords_etc_shadow_question:question:1">
          <ocil:question_text>To verify that null passwords cannot be used, run the following command:
$ sudo awk -F: '!$2 {print $1}' /etc/shadow
If this produces any output, it may be possible to log into accounts
with empty passwords.
      Is it the case that Blank or NULL passwords can be used?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_files_unowned_by_user_question:question:1">
          <ocil:question_text>The following command will locate the mount points related to local devices:
$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

The following command will show files which do not belong to a valid user:
$ sudo find MOUNTPOINT -xdev -nouser 2&gt;/dev/null

Replace MOUNTPOINT by the mount points listed by the fist command.

No files without a valid user should be located.
      Is it the case that files exist that are not owned by a valid user?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_usbguard_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the usbguard package is installed: $ rpm -q usbguard
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_noexec_question:question:1">
          <ocil:question_text>To determine if NOEXEC has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\bnoexec\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that noexec is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_postqueue_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "postqueue" command with the following command:

$ sudo auditctl -l | grep postqueue

-a always,exit -F path=/usr/bin/postqueue -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-postqueue
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_scap-security-guide_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the scap-security-guide package is installed: $ rpm -q scap-security-guide
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_core_pattern_empty_string_question:question:1">
          <ocil:question_text>The runtime status of the kernel.core_pattern kernel parameter can be queried
by running the following command:
$ sysctl kernel.core_pattern | cat -A
kernel.core_pattern = $

      Is it the case that the returned line does not have an empty string?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_cpu_time_max_percent kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_cpu_time_max_percent
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_admin_username_question:question:1">
          <ocil:question_text>To verify the boot loader superuser account has been set, run the following
command:
sudo grep -A1 "superusers" /boot/grub2/grub.cfg
The output should show the following:
set superusers="superusers-account"
export superusers
where superusers-account is the actual account name different from common names like root,
admin, or administrator and different from any other existing user name.
      Is it the case that superuser account is not set or is set to root, admin, administrator or any other existing user name?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_delete_failed_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-4-delete-failed.rules
The output has to be exactly as follows:
## Unsuccessful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-delete    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwquality_password_auth_question:question:1">
          <ocil:question_text>To check if pam_pwquality.so is enabled in password-auth, run the following command:
$ grep pam_pwquality /etc/pam.d/password-auth
The output should be similar to the following:
password requisite pam_pwquality.so
      Is it the case that pam_pwquality.so is not enabled in password-auth?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_explicit_command_args_question:question:1">
          <ocil:question_text>To determine if arguments that commands can be executed with are restricted, run the following command:
$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))' /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that /etc/sudoers file contains user specifications that allow execution of commands with any arguments?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_avahi-daemon_disabled_question:question:1">
          <ocil:question_text>To check that the avahi-daemon service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled avahi-daemon
Output should indicate the avahi-daemon service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled avahi-daemon disabled

Run the following command to verify avahi-daemon is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active avahi-daemon

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the avahi-daemon is masked, run the following command:
$ sudo systemctl show avahi-daemon | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "avahi-daemon" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_pam_wheel_group_empty_question:question:1">
          <ocil:question_text>Run the following command to check if the  group exists:
grep  /etc/group
The output should contain the following line:
:x:
      Is it the case that group  exists and has no user members?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_core_pattern_question:question:1">
          <ocil:question_text>The runtime status of the kernel.core_pattern kernel parameter can be queried
by running the following command:
$ sysctl kernel.core_pattern
|/bin/false.

      Is it the case that the returned line does not have a value of "|/bin/false", or a line is not
returned and the need for core dumps is not documented with the Information
System Security Officer (ISSO) as an operational requirement?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command:

$ sudo auditctl -l | grep -E '(/etc/gshadow)'

-w /etc/gshadow -p wa -k identity

If the command does not return a line, or the line is commented out, this is a finding.
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_x11_use_localhost_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11UseLocalhost option is set, run the following command:

$ sudo grep -i X11UseLocalhost /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.
      Is it the case that the display proxy is listening on wildcard address?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /dev/shm mount point,
    run the following command:
    $ sudo mount | grep '\s/dev/shm\s'
    . . . /dev/shm . . . noexec . . .

      Is it the case that the "/dev/shm" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_panic_timeout_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PANIC_TIMEOUT /boot/config.*
    
    For each kernel installed, a line with value "" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.max_addresses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.max_addresses
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_chrony_keys_question:question:1">
          <ocil:question_text>To check the ownership of /etc/chrony.keys,
run the command:
$ ls -lL /etc/chrony.keys
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/chrony.keys does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" with the following command:

$ sudo auditctl -l | grep -E '(/etc/group)'

-w /etc/group -p wa -k identity
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.ip_forward kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_forward
0.
The ability to forward packets is only appropriate for routers.
      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_pcscd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
pcscd service:
$ sudo systemctl is-active pcscd
If the service is running, it should return the following: active
      Is it the case that the pcscd service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_poisoning_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_POISONING /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_passwd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd,
run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
          <ocil:question_text>Inspect the password section of /etc/pam.d/system-auth
and ensure that the pam_unix.so module is configured to use the argument
:

$ sudo grep "^password.*pam_unix\.so.*" /etc/pam.d/system-auth

password sufficient pam_unix.so 
      Is it the case that "&lt;sub idref="var_password_hashing_algorithm_pam" /&gt;" is missing, or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_user_data_backups_question:question:1">
          <ocil:question_text>Verify that the system backups user data.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
          <ocil:question_text>To determine if NOPASSWD has been configured for the vdsm user for sudo,
run the following command:
$ sudo grep -ri nopasswd /etc/sudoers.d/
The command should return output only for the vdsm user.
      Is it the case that nopasswd is set for any users beyond vdsm?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsyslog-gnutls package is installed:
$ rpm -q rsyslog-gnutls
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
          <ocil:question_text>To verify the audispd's syslog plugin is active, run the following command:
$ sudo grep active /etc/audit/plugins.d/syslog.conf
If the plugin is active, the output will show yes.
      Is it the case that it is not activated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_group_question:question:1">
          <ocil:question_text>To check the permissions of /etc/group-,
run the command:
$ ls -l /etc/group-
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group- does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_systemmap_question:question:1">
          <ocil:question_text>To check the ownership of /boot/System.map*,
run the command:
$ ls -lL /boot/System.map*
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/System.map* does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_tmp_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /var/tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/var/tmp\s'
    . . . /var/tmp . . . noexec . . .

      Is it the case that the "/var/tmp" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_squid_disabled_question:question:1">
          <ocil:question_text>To check that the squid service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled squid
Output should indicate the squid service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled squid disabled

Run the following command to verify squid is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active squid

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the squid is masked, run the following command:
$ sudo systemctl show squid | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "squid" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_crontab_question:question:1">
          <ocil:question_text>To check the permissions of /etc/crontab,
run the command:
$ ls -l /etc/crontab
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /etc/crontab does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
          <ocil:question_text>To determine if !authenticate has not been configured for sudo, run the following command:
$ sudo grep -r \!authenticate /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that !authenticate is specified in the sudo config files?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_group_ownership_var_log_audit_question:question:1">
          <ocil:question_text>Check group owners of the system audit logs.

First, determine where the audit log file is located.

$ sudo grep -iw ^log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

The log_file option specifies the audit log file path.
If the log_file option isn't defined, check all files within /var/log/audit directory.


Then, determine the audit log group by running the following command:
$ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf


Then, check that the audit log file is owned by the correct group.
Run the following command to display the owner of the audit log file:

$ sudo stat -c "%n %G" log_file


The audit log file must be owned by the log_group or by root if the log_group is not specified.
      Is it the case that audit log files are owned by incorrect group?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_restrict_privilege_elevation_to_authorized_question:question:1">
          <ocil:question_text>Determine if "sudoers" file restricts sudo access run the following commands:
$ sudo grep -PR '^\s*ALL\s+ALL\=\(ALL\)\s+ALL\s*$' /etc/sudoers /etc/sudoers.d/*
$ sudo grep -PR '^\s*ALL\s+ALL\=\(ALL\:ALL\)\s+ALL\s*$' /etc/sudoers /etc/sudoers.d/*
      Is it the case that either of the commands returned a line?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_privileged_commands_init_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "init" command with the following command:

$ sudo auditctl -l | grep init

-a always,exit -F path=/init -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-init
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_group_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/group-,
run the command:
$ ls -lL /etc/group-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/group- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_bind_crypto_policy_question:question:1">
          <ocil:question_text>To verify that BIND uses the system crypto policy, check out that the BIND config file
/etc/named.conf contains the include "/etc/crypto-policies/back-ends/bind.config";
directive:
$ sudo grep 'include "/etc/crypto-policies/back-ends/bind.config";' /etc/named.conf
Verify that the directive is at the bottom of the options section of the config file.
      Is it the case that BIND is installed and the BIND config file doesn't contain the
&lt;pre&gt;include "/etc/crypto-policies/back-ends/bind.config";&lt;/pre&gt; directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_accept_default_question:question:1">
          <ocil:question_text>The runtime status of the kernel.unprivileged_bpf_disabled
kernel parameter can be queried by running the following command:
$ sysctl kernel.unprivileged_bpf_disabled
The output of the command should indicate either:
kernel.unprivileged_bpf_disabled = 1
or:
kernel.unprivileged_bpf_disabled = 2
The output of the command should not indicate:
kernel.unprivileged_bpf_disabled = 0

The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*\s*=' /etc/sysctl.conf /etc/sysctl.d
The command should not find any assignments other than:
kernel.unprivileged_bpf_disabled = 1
or:
kernel.unprivileged_bpf_disabled = 2

Duplicate assignments are not allowed. Empty output is allowed, because the system default is 2.
      Is it the case that the kernel.unprivileged_bpf_disabled is not set to 1 or 2 or is configured to be 0?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "newgrp" command with the following command:

$ sudo auditctl -l | grep newgrp

-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-newgrp
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_regular_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_regular kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_regular
2.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_auditd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
auditd service:
$ sudo systemctl is-active auditd
If the service is running, it should return the following: active
      Is it the case that the auditd service is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rsyncd_disabled_question:question:1">
          <ocil:question_text>To check that the rsyncd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled rsyncd
Output should indicate the rsyncd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled rsyncd disabled

Run the following command to verify rsyncd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active rsyncd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the rsyncd is masked, run the following command:
$ sudo systemctl show rsyncd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "rsyncd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_owner_etc_ipsecd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/ipsec.d,
run the command:
$ ls -lL /etc/ipsec.d
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/ipsec.d does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_kexec_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_KEXEC /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_rmdir_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
adjtimex system call, run the following command:
$ sudo grep "adjtimex" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's IgnoreUserKnownHosts option is set, run the following command:

$ sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_question:question:1">
          <ocil:question_text>To check the ownership of /var/log,
run the command:
$ ls -lL /var/log
If properly configured, the output should indicate the following owner:
root
      Is it the case that /var/log does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_run_as_chrony_user_question:question:1">
          <ocil:question_text># grep "^OPTIONS.*-u" /etc/sysconfig/chronyd | grep -v -e '-u\s*chrony\b'
returns no output
      Is it the case that chronyd is not running under chrony user account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_pam_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's UsePAM option is set, run the following command:

$ sudo grep -i UsePAM /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_network_listening_disabled_question:question:1">
          <ocil:question_text>Run the following command to ensure postfix accepts mail messages from only the local system:
$ grep inet_interfaces /etc/postfix/main.cf
If properly configured, the output should show only .
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_sestatus_conf_question:question:1">
          <ocil:question_text>To check the ownership of /etc/sestatus.conf,
run the command:
$ ls -lL /etc/sestatus.conf
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/sestatus.conf does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_error_action_stig_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 takes the appropriate action when an audit processing failure occurs.

Check that Oracle Linux 9 takes the appropriate action when an audit processing failure occurs with the following command:

$ sudo grep disk_error_action /etc/audit/auditd.conf

disk_error_action = HALT

If the value of the "disk_error_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit process failure occurs.
      Is it the case that there is no evidence of appropriate action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 is securely comparing internal information system clocks at a regular interval with an NTP server with the following command:
$ sudo grep maxpoll /etc/ntp.conf /etc/chrony.conf /etc/chrony.d/
server [ntp.server.name] iburst maxpoll .
      Is it the case that "maxpoll" has not been set to the value of "&lt;sub idref="var_time_service_set_maxpoll" /&gt;", is commented out, or is missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/tmp\s'
    . . . /tmp . . . noexec . . .

      Is it the case that the "/tmp" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_ssh_sysadm_login_question:question:1">
          <ocil:question_text>
Run the following command to determine if the ssh_sysadm_login SELinux boolean is disabled:
$ getsebool ssh_sysadm_login
If properly configured, the output should show the following:
ssh_sysadm_login --&gt; off
      Is it the case that ssh_sysadm_login is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the following command
to search privileged commands in relevant partitions and check if they are covered by auditd
rules:

FILTER_NODEV=$(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
PARTITIONS=$(findmnt -n -l -k -it $FILTER_NODEV | grep -Pv "noexec|nosuid" | awk '{ print $1 }')
for PARTITION in $PARTITIONS; do
  for PRIV_CMD in $(find "${PARTITION}" -xdev -perm /6000 -type f 2&gt;/dev/null); do
    grep -qr "${PRIV_CMD}" /etc/audit/rules.d /etc/audit/audit.rules &amp;&amp;
      printf "OK: ${PRIV_CMD}\n" || printf "WARNING - rule not found for: ${PRIV_CMD}\n"
  done
done

The output should not contain any WARNING.
      Is it the case that any setuid or setgid programs doesn't have a line in the audit rules?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_systemmap_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/System.map*,
run the command:
$ ls -lL /boot/System.map*
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/System.map* does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_noexec_remote_filesystems_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for all NFS mounts, run the following command:
$ mount | grep nfs
All NFS mounts should show the noexec setting in parentheses.  This is not applicable if NFS is
not implemented.
      Is it the case that the setting does not show?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_maxstartups_question:question:1">
          <ocil:question_text>To check if MaxStartups is configured, run the following command:
$ sudo grep -r ^[\s]*MaxStartups /etc/ssh/sshd_config*
If configured, this command should output the configuration.
      Is it the case that maxstartups is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_configure_pool_and_server_question:question:1">
          <ocil:question_text>Run the following command and verify remote servers are configured properly:
# grep -E "^(server|pool)" /etc/chrony.conf
      Is it the case that a remote time server is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_groupowner_etc_nftables_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/nftables,
run the command:
$ ls -lL /etc/nftables
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/nftables does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_daily_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.daily,
run the command:
$ ls -lL /etc/cron.daily
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.daily does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_unix_update_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "unix_update" command with the following command:

$ sudo auditctl -l | grep unix_update

-a always,exit -F path=/usr/bin/unix_update -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix_update
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_percentage_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 takes action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command:

$ sudo grep -w space_left /etc/audit/auditd.conf

space_left = %
      Is it the case that the value of the "space_left" keyword is not set to &lt;sub idref="var_auditd_space_left_percentage" /&gt;% of the storage volume allocated to audit logs, or if the line is commented out, ask the System Administrator to indicate how the system is providing real-time alerts to the SA and ISSO. If the "space_left" value is not configured to the correct value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the usb-storage kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the usb-storage kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_question:question:1">
          <ocil:question_text>To verify the number of rounds for the password hashing algorithm is configured, run the following command:
$ sudo grep rounds /etc/pam.d/password-auth
The output should show the following match:

password sufficient pam_unix.so sha512 rounds=
      Is it the case that rounds is not set to &lt;sub idref="var_password_pam_unix_rounds" /&gt; or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_modify_failed_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-2-modify-failed.rules
The output has to be exactly as follows:
## Unsuccessful file modifications (open for write or truncate)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S open -F a1&amp;01003 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b32 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification
-a always,exit -F arch=b64 -S truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-modification    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /var/log/audit mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log/audit\s'
    . . . /var/log/audit . . . noexec . . .

      Is it the case that the "/var/log/audit" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_acpi_custom_method_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_ACPI_CUSTOM_METHOD /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_root_password_login_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:

$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config

If a line indicating prohibit-password is returned, then the required value is set.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_interactive_users_question:question:1">
          <ocil:question_text>Verify that the default umask for all local interactive users is "077".

Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file.

Check all local interactive user initialization files for interactive users with the following command:

Note: The example is for a system that is configured to create users home directories in the "/home" directory.

$ sudo find /home -maxdepth 2 -type f -name ".[^.]*" -exec grep -iH -d skip --exclude=.bash_history umask {} \;

/home/wadea/.bash_history:grep -i umask /etc/bashrc /etc/csh.cshrc /etc/profile
/home/wadea/.bash_history:grep -i umask /etc/login.defs
      Is it the case that any local interactive user initialization files are found to have a umask statement that sets a value less restrictive than "077"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    . . . /boot . . . noexec . . .

      Is it the case that the "/boot" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sssd_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sssd package is installed: $ rpm -q sssd
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-timer_dnf-automatic_enabled_question:question:1">
          <ocil:question_text> Run the following command to determine the current status of the dnf-automatic timer: $ sudo systemctl is-active dnf-automatic.timer If the timer is running, it should return the following: active
      Is it the case that the dnf-automatic.timer is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_crypttab_question:question:1">
          <ocil:question_text>To check the permissions of /etc/crypttab,
run the command:
$ ls -l /etc/crypttab
If properly configured, the output should indicate the following permissions:
0600
      Is it the case that /etc/crypttab does not have unix mode 0600?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_owner_change_failed_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-6-owner-change-failed.rules
The output has to be exactly as follows:
## Unsuccessful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-owner-change    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_user_interactive_home_directory_exists_question:question:1">
          <ocil:question_text>Verify the assigned home directories of all interactive users on the system exist with the following command:

$ sudo pwck -r

user 'mailnull': directory 'var/spool/mqueue' does not exist

The output should not return any interactive users.
      Is it the case that users home directory does not exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_generate_policy_question:question:1">
          <ocil:question_text>Verify the USBGuard has a policy configured with the following command:

$ usbguard list-rules

allow id 1d6b:0001 serial

If the command does not return results or an error is returned, ask the SA to indicate how unauthorized peripherals are being blocked.
      Is it the case that there is no evidence that unauthorized peripherals are being blocked before establishing a connection?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_compression_question:question:1">
          <ocil:question_text>To check if compression is enabled or set correctly, run the
following command:
$ sudo grep Compression /etc/ssh/sshd_config
If configured properly, output should be no or delayed.
      Is it the case that it is commented out, or is not set to no or delayed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_confinement_of_daemons_question:question:1">
          <ocil:question_text>Ensure there are no unconfined daemons running on the system,
the following command should produce no output:
$ sudo ps -eZ | grep "unconfined_service_t"
      Is it the case that There are unconfined daemons running on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_root_owned_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not owned by root. Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +0 -print
      Is it the case that there are world-writable directories not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_stime_question:question:1">
          <ocil:question_text>If the system is not configured to audit time changes, this is a finding.
If the system is 64-bit only, this is not applicable
ocil: |
To determine if the system is configured to audit calls to the
stime system call, run the following command:
$ sudo grep "stime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_chcon_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "chcon" command with the following command:

$ sudo auditctl -l | grep chcon

-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_systemd-coredump_disabled_question:question:1">
          <ocil:question_text>To verify that acquiring, saving, and processing core dumps is disabled, run the
following command:
$ systemctl status systemd-coredump.socket
The output should be similar to:
● systemd-coredump.socket
   Loaded: masked (Reason: Unit systemd-coredump.socket is masked.)
   Active: inactive (dead) ...

      Is it the case that unit systemd-coredump.socket is not masked or running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /home mount point,
    run the following command:
    $ sudo mount | grep '\s/home\s'
    . . . /home . . . nosuid . . .

      Is it the case that the "/home" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_groupownership_question:question:1">
          <ocil:question_text>The group-owner of all log files written by rsyslog should be
root.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the group-owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the group-owner is not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_etc_iptables_question:question:1">
          <ocil:question_text>To check the permissions of /etc/iptables,
run the command:
$ ls -l /etc/iptables
If properly configured, the output should indicate the following permissions:
0700
      Is it the case that /etc/iptables does not have unix mode 0700?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_flush_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to synchronize audit event data
with the log files on the disk:
$ sudo grep flush /etc/audit/auditd.conf
flush = DATA
Acceptable values are DATA, and SYNC. The setting is
case-insensitive.
      Is it the case that auditd is not configured to synchronously write audit event data to disk?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /var mount point,
    run the following command:
    $ sudo mount | grep '\s/var\s'
    . . . /var . . . nosuid . . .

      Is it the case that the "/var" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_sg_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_SG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_wx_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_WX /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitUserEnvironment option is set, run the following command:

$ sudo grep -i PermitUserEnvironment /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_access_success_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-3-access-success.rules
The output has to be exactly as follows:
## Successful file access (any other opens) This has to go last.
## These next two are likely to result in a whole lot of events
-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access
-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-access    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-group_unique_id_question:question:1">
          <ocil:question_text>Run the following command to check for duplicate group names:
Check that the operating system contains no duplicate Group ID (GID) for interactive users by running the following command:

    cut -d : -f 3 /etc/group | uniq -d

If output is produced, this is a finding.
Configure the operating system to contain no duplicate GIDs.
Edit the file "/etc/group" and provide each group that has a duplicate GID with a unique GID.
      Is it the case that the system has duplicate group ids?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_s-nail_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the s-nail package is installed: $ rpm -q s-nail
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_issue_net_question:question:1">
          <ocil:question_text>To check the ownership of /etc/issue.net,
run the command:
$ ls -lL /etc/issue.net
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/issue.net does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_question:question:1">
          <ocil:question_text>Verify the operating system authenticates the remote logging server for off-loading audit logs with the following command:

$ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
$/etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name
      Is it the case that $ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_ipsec_secrets_question:question:1">
          <ocil:question_text>To check the ownership of /etc/ipsec.secrets,
run the command:
$ ls -lL /etc/ipsec.secrets
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/ipsec.secrets does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_fifos_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_fifos kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_fifos
2.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /var with the following command:

$ mountpoint /var

      Is it the case that "/var is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_ipsec_conf_question:question:1">
          <ocil:question_text>To check the ownership of /etc/ipsec.conf,
run the command:
$ ls -lL /etc/ipsec.conf
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/ipsec.conf does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /var/log/audit mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log/audit\s'
    . . . /var/log/audit . . . nosuid . . .

      Is it the case that the "/var/log/audit" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_remove_nopasswd_question:question:1">
          <ocil:question_text>To determine if NOPASSWD has been configured for sudo, run the following command:
$ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd is specified in the sudo config files?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_tmp_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /var/tmp mount point,
    run the following command:
    $ sudo mount | grep '\s/var/tmp\s'
    . . . /var/tmp . . . nodev . . .

      Is it the case that the "/var/tmp" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
          <ocil:question_text>Verify that the shadow password suite configuration is set to encrypt password with a FIPS 140-3 approved cryptographic hashing algorithm.


Check the hashing algorithm that is being used to hash passwords with the following command:

$ sudo grep -i ENCRYPT_METHOD /etc/login.defs

ENCRYPT_METHOD 
      Is it the case that ENCRYPT_METHOD is not set to &lt;sub idref="var_password_hashing_algorithm" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_autofs_disabled_question:question:1">
          <ocil:question_text>To check that the autofs service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled autofs
Output should indicate the autofs service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled autofs disabled

Run the following command to verify autofs is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active autofs

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the autofs is masked, run the following command:
$ sudo systemctl show autofs | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "autofs" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_issue_net_question:question:1">
          <ocil:question_text>To check the permissions of /etc/issue.net,
run the command:
$ ls -l /etc/issue.net
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/issue.net does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-xwindows_runlevel_target_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to boot to the command line:
$ systemctl get-default
multi-user.target
      Is it the case that the system default target is not set to "multi-user.target" and the Information System Security Officer (ISSO) lacks a documented requirement for a graphical user interface?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_ctrlaltdel_burstaction_question:question:1">
          <ocil:question_text>To ensure the system is configured to ignore the Ctrl-Alt-Del setting,
enter the following command:
$ sudo grep -i ctrlaltdelburstaction /etc/systemd/system.conf
The output should return:
CtrlAltDelBurstAction=none
      Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed more than 7 times in 2 seconds.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
          <ocil:question_text>To ensure the X Windows package group is removed, run the following command:
$ rpm -qi xorg-x11-server-common
The output should be:
package xorg-x11-server-common is not installed
      Is it the case that the X Windows package group or xorg-x11-server-common has not be removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_noexec_question:question:1">
          <ocil:question_text>Verify the noexec option is configured for the /var/log mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log\s'
    . . . /var/log . . . noexec . . .

      Is it the case that the "/var/log" file system does not have the "noexec" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates an audit record for unsuccessful attempts to use the openat system call.

If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command:

$ sudo grep -r openat /etc/audit/rules.d

If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command:

$ sudo grep openat /etc/audit/audit.rules

The output should be the following:

-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_sudoers_question:question:1">
          <ocil:question_text>To check the permissions of /etc/sudoers,
run the command:
$ ls -l /etc/sudoers
If properly configured, the output should indicate the following permissions:
0440
      Is it the case that /etc/sudoers does not have unix mode 0440?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-security_patches_up_to_date_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 security patches and updates are installed and up to date.
Updates are required to be applied with a frequency determined by organizational policy.



Typical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.
      Is it the case that Oracle Linux 9 is in non-compliance with the organizational patching policy?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_ospp_general_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42.rules
The output has to be exactly as follows:
## The purpose of these rules is to meet the requirements for Operating
## System Protection Profile (OSPP)v4.2. These rules depends on having
## the following rule files copied to /etc/audit/rules.d:
##
## 10-base-config.rules, 11-loginuid.rules,
## 30-ospp-v42-1-create-failed.rules, 30-ospp-v42-1-create-success.rules,
## 30-ospp-v42-2-modify-failed.rules, 30-ospp-v42-2-modify-success.rules,
## 30-ospp-v42-3-access-failed.rules, 30-ospp-v42-3-access-success.rules,
## 30-ospp-v42-4-delete-failed.rules, 30-ospp-v42-4-delete-success.rules,
## 30-ospp-v42-5-perm-change-failed.rules,
## 30-ospp-v42-5-perm-change-success.rules,
## 30-ospp-v42-6-owner-change-failed.rules,
## 30-ospp-v42-6-owner-change-success.rules

## User add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch passwd and
## shadow for writes
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/passwd -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -S open -F a1&amp;03 -F path=/etc/shadow -F auid&gt;=1000 -F auid!=unset -F key=user-modify

## User enable and disable. This is entirely handled by pam.

## Group add delete modify. This is covered by pam. However, someone could
## open a file and directly create or modify a user, so we'll watch group and
## gshadow for writes
-a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=user-modify
-a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify
-a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=group-modify


## Use of special rights for config changes. This would be use of setuid
## programs that relate to user accts. This is not all setuid apps because
## requirements are only for ones that affect system configuration.
-a always,exit -F arch=b32 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/usernetctl -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/userhelper -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/seunshare -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/mount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newuidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/newgidmap -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/bin/at -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b32 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/usr/sbin/grub2-set-bootflag -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=special-config-changes

## Privilege escalation via su or sudo. This is entirely handled by pam.
## Special case for systemd-run. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/systemd-run -F perm=x -F auid!=unset -F key=maybe-escalation
## Special case for pkexec. It is not audit aware, specifically watch it
-a always,exit -F arch=b32 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation
-a always,exit -F arch=b64 -F path=/usr/bin/pkexec -F perm=x -F key=maybe-escalation


## Watch for configuration changes to privilege escalation.
-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes

## Audit log access
-a always,exit -F arch=b32 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
-a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=r -F auid&gt;=1000 -F auid!=unset -F key=access-audit-trail
## Attempts to Alter Process and Session Initiation Information
-a always,exit -F arch=b32 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/run/utmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/btmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b32 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session
-a always,exit -F arch=b64 -F path=/var/log/wtmp -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=session

## Attempts to modify MAC controls
-a always,exit -F arch=b32 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy
-a always,exit -F arch=b64 -F dir=/etc/selinux/ -F perm=wa -F auid&gt;=1000 -F auid!=unset -F key=MAC-policy

## Software updates. This is entirely handled by rpm.

## System start and shutdown. This is entirely handled by systemd

## Kernel Module loading. This is handled in 43-module-load.rules

## Application invocation. The requirements list an optional requirement
## FPT_SRP_EXT.1 Software Restriction Policies. This event is intended to
## state results from that policy. This would be handled entirely by
## that daemon.    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_crond_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
crond service:
$ sudo systemctl is-active crond
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.secure_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_cron_d_question:question:1">
          <ocil:question_text>To check the permissions of /etc/cron.d,
run the command:
$ ls -l /etc/cron.d
If properly configured, the output should indicate the following permissions:
-rwx------
      Is it the case that /etc/cron.d does not have unix mode -rwx------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsyslog_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsyslog package is installed: $ rpm -q rsyslog
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /var mount point,
    run the following command:
    $ sudo mount | grep '\s/var\s'
    . . . /var . . . nodev . . .

      Is it the case that the "/var" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
settimeofday system call, run the following command:
$ sudo grep "settimeofday" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_hash_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_HASH /boot/config.*
    
    For each kernel installed, a line with value "" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_local_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_local kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_local
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-require_singleuser_auth_question:question:1">
          <ocil:question_text>To check if authentication is required for single-user mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/rescue.service
The output should be similar to the following, and the line must begin with
ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

In case the output does not match, check if the ExecStart directive is not overridden:
grep ExecStart /etc/systemd/system/rescue.service.d/*.conf
The output should contain two lines:
ExecStart=
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue



Then, verify that the rescue service is in the runlevel1.target.
Run the following command:
$ sudo grep "^Requires=.*rescue\.service" /usr/lib/systemd/system/runlevel1.target
The output should be the following:
Requires=sysinit.target rescue.service

Then, check if there is no custom runlevel1 target configured in systemd configuration.
Run the following command:
$ sudo grep -r "^runlevel1.target$" /etc/systemd/system
There should be no output.

Then, check if there is no custom rescue service configured in systemd configuration.
Run the following command:
$ sudo grep -r "^rescue.service$" /etc/systemd/system
There should be no output.
      Is it the case that the output is different?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
          <ocil:question_text>To ensure a login warning banner is enabled, run the following:
$ grep banner-message-enable /etc/dconf/db/local.d/*
If properly configured, the output should be true.
To ensure a login warning banner is locked and cannot be changed by a user, run the following:
$ grep banner-message-enable /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-enable.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
          <ocil:question_text>Verify the value of the "maxclassrepeat" option in "/etc/security/pwquality.conf" with the following command:

$ grep maxclassrepeat /etc/security/pwquality.conf

maxclassrepeat = 
      Is it the case that the value of "maxclassrepeat" is set to "0", more than "&lt;sub idref="var_password_pam_maxclassrepeat" /&gt;" or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_uefi_password_question:question:1">
          <ocil:question_text>To verify the boot loader superuser password has been set, run the following command:
$ sudo grep "^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$" /boot/grub2/user.cfg
The output should be similar to:
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828
      Is it the case that no password is set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_tls_question:question:1">
          <ocil:question_text>To verify that rsyslog's Forwarding Output Module is configured
to use TLS for logging to remote server, run the following command:
$ grep omfwd /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include record similar to
action(type="omfwd" protocol="tcp" Target="&lt;remote system&gt;" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")

where the &lt;remote system&gt; present in the configuration line above must be a valid IP address or a host name of the remote logging server.
      Is it the case that omfwd is not configured with gtls and AuthMode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_source_route
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_cron_weekly_question:question:1">
          <ocil:question_text>To check the permissions of /etc/cron.weekly,
run the command:
$ ls -l /etc/cron.weekly
If properly configured, the output should indicate the following permissions:
-rwx------
      Is it the case that /etc/cron.weekly does not have unix mode -rwx------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_question:question:1">
          <ocil:question_text>Verify the operating system encrypts audit records off-loaded onto a different system
or media from the system being audited with the following commands:

$ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf

The output should be:

/etc/rsyslog.conf:$DefaultNetstreamDriver gtls
      Is it the case that rsyslogd DefaultNetstreamDriver not set to gtls?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_fapolicyd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
fapolicyd service:
$ sudo systemctl is-active fapolicyd
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsh-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsh-server package is installed:
$ rpm -q rsh-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_compat_brk_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_COMPAT_BRK /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slab_freelist_random_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLAB_FREELIST_RANDOM /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sendmail_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sendmail package is installed:
$ rpm -q sendmail
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_full_action_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 takes the appropriate action when the audit storage volume is full.

Check that Oracle Linux 9 takes the appropriate action when the audit storage volume is full with the following command:

$ sudo grep disk_full_action /etc/audit/auditd.conf

disk_full_action = 

If the value of the "disk_full_action" option is not "SYSLOG", "SINGLE", or "HALT", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full.
      Is it the case that there is no evidence of appropriate action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_require_reauthentication_question:question:1">
          <ocil:question_text>Verify the operating system requires re-authentication
when using the "sudo" command to elevate privileges, run the following command:
sudo grep -ri '^Defaults.*timestamp_timeout' /etc/sudoers /etc/sudoers.d
The output should be:
/etc/sudoers:Defaults timestamp_timeout=0 or "timestamp_timeout" is set to a positive number.
If conflicting results are returned, this is a finding.
      Is it the case that timestamp_timeout is not set with the appropriate value for sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
          <ocil:question_text>To ensure that remote access connections are encrypted, run the following command:
$ gsettings get org.gnome.Vino require-encrpytion
If properly configured, the output should be true.
To ensure that users cannot disable encrypted remote connections, run the following:
$ grep require-encryption /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/require-encryption
      Is it the case that remote access connections are not encrypted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_at_allow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/at.allow,
run the command:
$ ls -lL /etc/at.allow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/at.allow does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitEmptyPasswords option is set, run the following command:

$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_require_authentication_question:question:1">
          <ocil:question_text>To determine if NOPASSWD or !authenticate have been configured for
sudo, run the following command:
$ sudo grep -ri "nopasswd\|\!authenticate" /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd and/or !authenticate is enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/gshadow,
run the command:
$ ls -l /etc/gshadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_certmap_question:question:1">
          <ocil:question_text>To verify Certmap is enabled in SSSD, run the following command:
$ sudo cat /etc/sssd/sssd.conf
If configured properly, output should contain section like the following

[certmap/testing.test/rule_name]
matchrule =&lt;SAN&gt;.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test

      Is it the case that Certmap is not configured in SSSD?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_hibernation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_HIBERNATION /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
          <ocil:question_text>To ensure disable and restart on the login screen are disabled, run the following command:
$ grep disable-restart-buttons /etc/dconf/db/local.d/*
The output should be true.
To ensure that users cannot enable disable and restart on the login screen, run the following:
$ grep disable-restart-buttons /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-restart-buttons
      Is it the case that disable-restart-buttons has not been configured or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_l1tf_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes l1tf=,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*l1tf=.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*l1tf=.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'l1tf='
The command should not return any output.
      Is it the case that l1tf mitigations are not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.send_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "crontab" command with the following command:

$ sudo auditctl -l | grep crontab

-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-crontab
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_limit_user_access_question:question:1">
          <ocil:question_text>To ensure sshd limits the users who can log in, run the following:
pre&gt;$ sudo grep -rPi '^\h*(allow|deny)(users|groups)\h+\H+(\h+.*)?$' /etc/ssh/sshd_config*
If properly configured, the output should be a list of usernames and/or
groups allowed to log in to this system.
      Is it the case that sshd does not limit the users who can log in?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
          <ocil:question_text>To find SGID files, run the following command:
$ sudo find / -xdev -type f -perm -2000
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_page_alloc_shuffle_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes page_alloc.shuffle=1,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*page_alloc.shuffle=1.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*page_alloc.shuffle=1.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'page_alloc.shuffle=1'
The command should not return any output.
      Is it the case that randomization of the page allocator is not enabled in the kernel?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_dconf_user_profile_question:question:1">
          <ocil:question_text>To verify that the DConf User profile is configured correctly, run the following
command:

$ cat /etc/dconf/profile/user
The output should show the following:
user-db:user
system-db:local
system-db:site
system-db:distro
      Is it the case that DConf User profile does not exist or is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
          <ocil:question_text>To check the screensaver mandatory use status, run the following command:
$ gsettings get org.gnome.desktop.screensaver idle-activation-enabled
If properly configured, the output should be true.
To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/idle-activation-enabled
      Is it the case that idle-activation-enabled is not enabled or configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_authselect_question:question:1">
          <ocil:question_text>Verify that authselect is enabled by running
authselect current
If authselect is enabled on the system, the output should show the ID of the profile which is currently in use.
      Is it the case that authselect is not used to manage user authentication setup on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_x86_vsyscall_emulation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_X86_VSYSCALL_EMULATION /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_sniffer_disabled_question:question:1">
          <ocil:question_text>Verify that Promiscuous mode of an interface is disabled, run the following command:
$ ip link | grep PROMISC
      Is it the case that any network device is in promiscuous mode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_cron_deny_not_exist_question:question:1">
          <ocil:question_text>The file /etc/cron.deny should not exist.
This can be checked by runnig the following

stat /etc/cron.deny

and the output should be

stat: cannot stat `/etc/cron.deny': No such file or directory

      Is it the case that the file /etc/cron.deny exists?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nftables_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nftables package is installed: $ rpm -q nftables
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_hourly_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.hourly,
run the command:
$ ls -lL /etc/cron.hourly
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.hourly does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_oddjobd_disabled_question:question:1">
          <ocil:question_text>To check that the oddjobd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled oddjobd
Output should indicate the oddjobd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled oddjobd disabled

Run the following command to verify oddjobd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active oddjobd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the oddjobd is masked, run the following command:
$ sudo systemctl show oddjobd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "oddjobd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_last_change_is_in_past_question:question:1">
          <ocil:question_text>Verify that the interactive user account passwords last change time is not in the future
The following command should return no output
$ sudo expiration=$(cat /etc/shadow|awk -F ':' '{print $3}');
for edate in ${expiration[@]}; do if [[ $edate &gt; $(( $(date +%s)/86400 )) ]];
then echo "Expiry date in future";
fi; done 
      Is it the case that any interactive user password that has last change time in the future?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tftp-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tftp-server package is installed:
$ rpm -q tftp-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_action_stig_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 takes the appropriate action when the audit files have reached maximum size.

Check that Oracle Linux 9 takes the appropriate action when the audit files have reached maximum size with the following command:

$ sudo grep max_log_file_action /etc/audit/auditd.conf

max_log_file_action = 
      Is it the case that the value of the "max_log_file_action" option is not "ROTATE", "SINGLE", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_group_ownership_library_dirs_question:question:1">
          <ocil:question_text>Verify the system-wide shared library directories are group-owned by "root" with the following command:

$ sudo find /lib /lib64 /usr/lib /usr/lib64 ! -group root -type d -exec stat -c "%n %G" '{}' \;

If any system-wide shared library directory is returned and is not group-owned by a required system account, this is a finding.
      Is it the case that any system-wide shared library directory is returned and is not group-owned by a required system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_check_audit_tools_question:question:1">
          <ocil:question_text>Check that AIDE is properly configured to protect the integrity of the
audit tools by running the following command:

# sudo cat /etc/aide.conf | grep /usr/sbin/au

/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512

/usr/sbin/rsyslogd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512


If AIDE is configured properly to protect the integrity of the audit tools,
all lines listed above will be returned from the command.

If one or more lines are missing, this is a finding.
      Is it the case that integrity checks of the audit tools are missing or incomplete?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
finit_module system call, run the following command:
$ sudo grep "finit_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configured_firewalld_default_deny_question:question:1">
          <ocil:question_text>Verify "firewalld" is configured to employ a deny-all, allow-by-exception policy for allowing connections to other systems with the following commands:

$ sudo firewall-cmd --state

running

$ sudo firewall-cmd --get-active-zones

[custom]
interfaces: ens33

$ sudo firewall-cmd --info-zone=[custom] | grep target

target: DROP
      Is it the case that no zones are active on the interfaces or if the target is set to a different option other than "DROP"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_audit_tools_group_ownership_question:question:1">
          <ocil:question_text>Verify the audit tools are group-owned by "root" to prevent any unauthorized access, deletion, or modification.

Check the group-owner of each audit tool by running the following command:

$ sudo stat -c "%G %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules

root /sbin/auditctl
root /sbin/aureport
root /sbin/ausearch
root /sbin/autrace
root /sbin/auditd
root /sbin/rsyslogd
root /sbin/augenrules
      Is it the case that any audit tools are not group-owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_shells_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shells,
run the command:
$ ls -l /etc/shells
If properly configured, the output should indicate the following permissions:
0644
      Is it the case that /etc/shells does not have unix mode 0644?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/*.pub,
run the command:
$ ls -l /etc/ssh/*.pub
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/ssh/*.pub does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_login_grace_time_question:question:1">
          <ocil:question_text>To ensure LoginGraceTime is set correctly, run the following command:
$ sudo grep LoginGraceTime /etc/ssh/sshd_config
If properly configured, the output should be:
LoginGraceTime 
If the option is set to a number greater than 0, then the unauthenticated session will be disconnected
after the configured number seconds.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_ownership_question:question:1">
          <ocil:question_text>The owner of all log files written by rsyslog should be

root.

These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the owner is not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_postfix_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
postfix service:
$ sudo systemctl is-active postfix
If the service is running, it should return the following: active
      Is it the case that the system is not a cross domain solution and the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_faillock_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command:

$ sudo auditctl -l | grep 

-w  -p wa -k logins
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
          <ocil:question_text>To verify that the installed operating system is supported, run
the following command:

$ grep -i "oracle" /etc/oracle-release

Oracle Linux 9
      Is it the case that the installed operating system is not supported?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_home_dirs_question:question:1">
          <ocil:question_text>To ensure the user home directory is not group-writable or world-readable, run the following:
# ls -ld /home/USER
      Is it the case that the user home directory is group-writable or world-readable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_etc_sysctld_question:question:1">
          <ocil:question_text>To check the permissions of /etc/sysctl.d,
run the command:
$ ls -l /etc/sysctl.d
If properly configured, the output should indicate the following permissions:
0755
      Is it the case that /etc/sysctl.d does not have unix mode 0755?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_sshd_config_question:question:1">
          <ocil:question_text>To check the ownership of /etc/ssh/sshd_config,
run the command:
$ ls -lL /etc/ssh/sshd_config
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/ssh/sshd_config does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following
permissions: -rwx------
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_privileged_commands_shutdown_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "shutdown" command with the following command:

$ sudo auditctl -l | grep shutdown

-a always,exit -F path=/shutdown -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-shutdown
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_firewalld_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
firewalld service:
$ sudo systemctl is-active firewalld
If the service is running, it should return the following: active
      Is it the case that the "firewalld" service is disabled, masked, or not started.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_chacl_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "chacl" command with the following command:

$ sudo auditctl -l | grep chacl

-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_quagga_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the quagga package is installed:
$ rpm -q quagga
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_client_only_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 disables the chrony daemon from acting as a server with the following command:
$ grep -w port /etc/chrony.conf
port 0
      Is it the case that the "port" option is not set to "0", is commented out, or is missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_ssh_agent_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "ssh-agent" command with the following command:

$ sudo auditctl -l | grep ssh-agent

-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-ssh-agent
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_certificate_verification_question:question:1">
          <ocil:question_text>Check to see if Online Certificate Status Protocol (OCSP)
is enabled and using the proper digest value on the system with the following command:
$ sudo grep certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf | grep -v "^#"
If configured properly, output should look like

    certificate_verification = ocsp_dgst=

      Is it the case that certificate_verification in sssd is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_sestatus_conf_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/sestatus.conf,
run the command:
$ ls -lL /etc/sestatus.conf
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/sestatus.conf does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_talk_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the talk package is installed:
$ rpm -q talk
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_fortify_source_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_FORTIFY_SOURCE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slab_merge_default_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLAB_MERGE_DEFAULT /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_rekey_limit_question:question:1">
          <ocil:question_text>To check if RekeyLimit is set correctly, run the
following command:

$ sudo grep RekeyLimit /etc/ssh/sshd_config

If configured properly, output should be
RekeyLimit  
      Is it the case that it is commented out or is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates an audit record for unsuccessful attempts to use the open_by_handle_at system call.

If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command:

$ sudo grep -r open_by_handle_at /etc/audit/rules.d

If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command:

$ sudo grep open_by_handle_at /etc/audit/audit.rules

The output should be the following:

-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_cron_hourly_question:question:1">
          <ocil:question_text>To check the permissions of /etc/cron.hourly,
run the command:
$ ls -l /etc/cron.hourly
If properly configured, the output should indicate the following permissions:
-rwx------
      Is it the case that /etc/cron.hourly does not have unix mode -rwx------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_password_pam_faillock_password_auth_question:question:1">
          <ocil:question_text>Verify the pam_faillock.so module is present in the "/etc/pam.d/password-auth" file:

$ sudo grep pam_faillock.so /etc/pam.d/password-auth

auth required pam_faillock.so preauth
auth required pam_faillock.so authfail
account required pam_faillock.so
      Is it the case that the pam_faillock.so module is not present in the "/etc/pam.d/password-auth" file with the "preauth" line listed before pam_unix.so?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_freq_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to flush to disk after
every  records, run the following command:
$ sudo grep freq /etc/audit/auditd.conf
The output should return the following:
freq = 
      Is it the case that freq isn't set to &lt;sub idref="var_auditd_freq" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_all_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_ALL /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_pinfo kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_pinfo
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-clients_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-clients package is installed: $ rpm -q openssh-clients
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_unmap_kernel_at_el0_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_ldap_configure_tls_reqcert_question:question:1">
          <ocil:question_text>To verify the LDAP client backend demands a valid certificate from the server in
remote LDAP access sessions, run the following command:
$ sudo grep ldap_tls_reqcert /etc/sssd/sssd.conf
The output should return the following:
ldap_tls_reqcert = demand
      Is it the case that the TLS reqcert is not set to demand?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_dictcheck_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 prevents the use of dictionary words for passwords with the following command:

$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf

/etc/security/pwquality.conf:dictcheck=1
      Is it the case that "dictcheck" does not have a value other than "0", or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_efi_user_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/grub2/user.cfg,
run the command:
$ ls -lL /boot/grub2/user.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/grub2/user.cfg does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_sched_stack_end_check_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SCHED_STACK_END_CHECK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_logrotate_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the logrotate package is installed: $ rpm -q logrotate
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_poisoning_no_sanity_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_POISONING_NO_SANITY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_session_idle_user_locks_question:question:1">
          <ocil:question_text>To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'idle-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return:
/org/gnome/desktop/session/idle-delay
      Is it the case that idle-delay is not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shadow-,
run the command:
$ ls -l /etc/shadow-
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/shadow- does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-firewalld_loopback_traffic_restricted_question:question:1">
          <ocil:question_text>Inspect the firewalld trusted and default zones and verify the loopback traffic is restricted
to the lo interface by running the following command:

$ sudo firewall-cmd --list-rich-rules --zone=trusted

The following rich-rules should be listed:

rule family="ipv4" source address="127.0.0.1" destination not address="127.0.0.1" drop
rule family="ipv6" source address="::1" destination not address="127.0.0.1" drop

      Is it the case that loopback traffic is not restricted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_polyinstantiation_enabled_question:question:1">
          <ocil:question_text>
Run the following command to get the current configured value for polyinstantiation_enabled
SELinux boolean:
$ getsebool polyinstantiation_enabled
The expected cofiguration is .
"on" means true, and "off" means false
      Is it the case that polyinstantiation_enabled is not set as expected?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_key_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_KEY /boot/config.*
    
    For each kernel installed, a line with value "" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_build_database_question:question:1">
          <ocil:question_text>To find the location of the AIDE database file, run the following command:
$ sudo ls -l DBDIR/database_file_name
      Is it the case that there is no database file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_groupowner_etc_sudoersd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/sudoers.d,
run the command:
$ ls -lL /etc/sudoers.d
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/sudoers.d does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_vsftpd_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the vsftpd package is installed:
$ rpm -q vsftpd
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_disable_inactivity_system_auth_question:question:1">
          <ocil:question_text>To verify the inactive setting, run the following command:
$ grep 'inactive\|pam_unix' /etc/pam.d/system-auth | grep -w auth
The output should indicate the inactive configuration option is set
to an appropriate integer between 1 and
; and should appear
before the pam_unix.so module as shown in the example below:
$ grep 'inactive\|pam_unix' /etc/pam.d/system-auth | grep -w auth
auth required pam_lastlog.so inactive=
auth sufficient pam_unix.so
      Is it the case that the value of inactive is incorrect or is not set before pam_unix.so?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_disable_inactivity_password_auth_question:question:1">
          <ocil:question_text>To verify the inactive setting, run the following command:
$ grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth
The output should indicate the inactive configuration option is set
to an appropriate integer between 1 and
; and should appear
before the pam_unix.so module as shown in the example below:
$ grep 'inactive\|pam_unix' /etc/pam.d/password-auth | grep -w auth
auth required pam_lastlog.so inactive=
auth sufficient pam_unix.so
      Is it the case that the value of inactive is incorrect or is not set before pam_unix.so?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_crypto_fips_enabled_question:question:1">
          <ocil:question_text>To verify that kernel parameter 'crypto.fips_enabled' is set properly, run the following command:
sysctl crypto.fips_enabled
The output should contain the following:
crypto.fips_enabled = 1
      Is it the case that crypto.fips_enabled is not 1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_crontab_question:question:1">
          <ocil:question_text>To check the ownership of /etc/crontab,
run the command:
$ ls -lL /etc/crontab
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/crontab does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_permissions_binary_dirs_question:question:1">
          <ocil:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
To find system executables directories that are group-writable or
world-writable, run the following command for each directory DIR
which contains system executables:
$ sudo find -L DIR -perm /022 -type d
      Is it the case that any of these files are group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_minlen_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces a minimum -character password length with the following command:

$ grep minlen /etc/security/pwquality.conf

minlen = 
      Is it the case that the command does not return a "minlen" value of "&lt;sub idref="var_password_pam_minlen" /&gt;" or greater, does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_groupowner_etc_ipsecd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/ipsec.d,
run the command:
$ ls -lL /etc/ipsec.d
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/ipsec.d does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_allow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.allow,
run the command:
$ ls -lL /etc/cron.allow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.allow does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 is configured to lock the root account after 
unsuccessful logon attempts with the command:

$ grep even_deny_root /etc/security/faillock.conf
even_deny_root
      Is it the case that the "even_deny_root" option is not set, is missing or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_defrtr kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_defrtr
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates an audit record for unsuccessful attempts to use the creat system call.

If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command:

$ sudo grep -r creat /etc/audit/rules.d

If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command:

$ sudo grep creat /etc/audit/audit.rules

The output should be the following:

-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_hardened_usercopy_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_HARDENED_USERCOPY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_automount_open_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount-open
If properly configured, the output for automount-openshould be false.
To ensure that users cannot enable automount opening in GNOME3, run the following:
$ grep 'automount-open' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount-open should be /org/gnome/desktop/media-handling/automount-open
      Is it the case that GNOME automounting is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_pubkey_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PubkeyAuthentication option is set, run the following command:

$ sudo grep -i PubkeyAuthentication /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to take action in the event of allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity with the following command:

$ sudo grep admin_space_left_action /etc/audit/auditd.conf

admin_space_left_action = single

If the value of the "admin_space_left_action" is not set to "single", or if the line is commented out, ask the System Administrator to indicate how the system is providing real-time alerts to the SA and ISSO.
      Is it the case that there is no evidence that real-time alerts are configured on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-use_pam_wheel_group_for_su_question:question:1">
          <ocil:question_text>Run the following command to check if the line is present:
grep pam_wheel /etc/pam.d/su
The output should contain the following line:
auth required pam_wheel.so use_uid group=
      Is it the case that the line is not in the file or it is commented?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_passwords_pam_faillock_dir_question:question:1">
          <ocil:question_text>Verify the "/etc/security/faillock.conf" file is configured use a non-default faillock directory to ensure contents persist after reboot:

$ sudo grep 'dir =' /etc/security/faillock.conf

dir = /var/log/faillock
      Is it the case that the "dir" option is not set to a non-default documented tally log directory, is missing or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_dir_question:question:1">
          <ocil:question_text>To ensure the tally directory is configured correctly, run the following command:
$ sudo grep 'dir =' /etc/security/faillock.conf
The output should show that dir is set to something other than "/var/run/faillock"
      Is it the case that the "dir" option is not set to a non-default documented tally log directory, is missing or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_init_on_alloc_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes init_on_alloc=1,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*init_on_alloc=1.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*init_on_alloc=1.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'init_on_alloc=1'
The command should not return any output.
      Is it the case that the kernel is not configured to zero out memory before allocation?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_strong_macs_question:question:1">
          <ocil:question_text>Only strong MACs should be used. To verify that only strong
MACs are in use, run the following command:
$ sudo grep -i macs /etc/ssh/sshd_config
The output should contain only those MACs which are strong, namely,
 hash functions.
      Is it the case that MACs option is commented out or not using strong hash algorithms?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "umount" command with the following command:

$ sudo auditctl -l | grep umount

-a always,exit -F path=/usr/bin/umount -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-umount
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_audit_backlog_limit_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes audit_backlog_limit=8192,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*audit_backlog_limit=8192.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*audit_backlog_limit=8192.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'audit_backlog_limit=8192'
The command should not return any output.
      Is it the case that audit backlog limit is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_postfix_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the postfix package is installed: $ rpm -q postfix
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_bug_on_data_corruption_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_BUG_ON_DATA_CORRUPTION /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_deny_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.deny,
run the command:
$ ls -lL /etc/cron.deny
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.deny does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.unprivileged_bpf_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.unprivileged_bpf_disabled
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_sysrq_question:question:1">
          <ocil:question_text>The runtime status of the kernel.sysrq kernel parameter can be queried
by running the following command:
$ sysctl kernel.sysrq
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_systemd-journald_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
systemd-journald service:
$ sudo systemctl is-active systemd-journald
If the service is running, it should return the following: active
      Is it the case that the systemd-journald service is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces password complexity by requiring that at least one special character with the following command:

$ sudo grep ocredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

ocredit = 
      Is it the case that value of "ocredit" is a positive number or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_user_home_paths_only_question:question:1">
          <ocil:question_text>Verify that all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories with the following commands:

$ sudo grep -i path= /home/*/.*

/home/[localinteractiveuser]/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin
      Is it the case that any local interactive user initialization files have executable search path statements that include directories outside of their home directory and is not documented with the ISSO as an operational requirement?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
          <ocil:question_text>Verify the audit log directories have a correct mode or less permissive mode.

Find the location of the audit logs:

$ sudo grep "^log_file" /etc/audit/auditd.conf


Find the group that owns audit logs:

$ sudo grep "^log_group" /etc/audit/auditd.conf


Run the following command to check the mode of the system audit logs:

$ sudo stat -c "%a %n" [audit_log_directory]

Replace "[audit_log_directory]" to the correct audit log directory path, by default this location is "/var/log/audit".


If the log_group is "root" or is not set, the correct permissions are 0700, otherwise they are 0750.
      Is it the case that audit logs have a more permissive mode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_default_mmap_min_addr_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
$ grep CONFIG_DEFAULT_MMAP_MIN_ADDR /boot/config.*
For each kernel installed, a line with value should be returned.
If the system architecture is x86_64, the value should be 65536.
If the system architecture is aarch64, the value should be 32768.
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount
If properly configured, the output for automount should be false.
To ensure that users cannot enable automount in GNOME3, run the following:
$ grep 'automount' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount should be /org/gnome/desktop/media-handling/automount
      Is it the case that GNOME automounting is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates an audit record for unsuccessful attempts to use the open system call.

If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command:

$ sudo grep -r open /etc/audit/rules.d

If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command:

$ sudo grep open /etc/audit/audit.rules

The output should be the following:

-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_host_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's HostbasedAuthentication option is set, run the following command:

$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_var_log_audit_question:question:1">
          <ocil:question_text>
To properly set the owner of /var/log/audit, run the command:
$ sudo chown root /var/log/audit 

To properly set the owner of /var/log/audit/*, run the command:
$ sudo chown root /var/log/audit/* 
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    . . . /boot . . . nosuid . . .

      Is it the case that the "/boot" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_write_logs_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to write logs to the disk, run the
following command:
$ sudo grep write_logs /etc/audit/auditd.conf
The output should return the following:
write_logs = yes
      Is it the case that write_logs isn't set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity with the following command:

$ sudo grep -w space_left_action /etc/audit/auditd.conf

space_left_action = 

If the value of the "space_left_action" is not set to "", or if the line is commented out, ask the System Administrator to indicate how the system is providing real-time alerts to the SA and ISSO.
      Is it the case that there is no evidence that real-time alerts are configured on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.max_addresses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.max_addresses
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.arp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.arp_filter
.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_module_sig_force_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODULE_SIG_FORCE /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_binary_dirs_question:question:1">
          <ocil:question_text>Verify the system commands contained in the following directories are owned by "root" with the following command:

$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/local/bin /usr/local/sbin ! -user root -exec ls -l {} \;
      Is it the case that any system commands are found to not be owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
          <ocil:question_text>To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=


In newer systems, the pam_pwhistory PAM module options can also be set in
"/etc/security/pwhistory.conf" file. Use the following command to verify:
$ grep remember /etc/security/pwhistory.conf
remember = 

The pam_pwhistory remember option must be configured only in one file.
      Is it the case that the value of remember is not equal to or greater than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_legacy_vsyscall_emulate_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_LEGACY_VSYSCALL_EMULATE /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_create_failed_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-1-create-failed.rules
The output has to be exactly as follows:
## Unsuccessful file creation (open with O_CREAT)
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S open -F a1&amp;0100 -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-create    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_efi_user_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/grub2/user.cfg,
run the command:
$ ls -lL /boot/grub2/user.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/grub2/user.cfg does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_oracle_gpgkey_installed_question:question:1">
          <ocil:question_text>To ensure that the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return the string below:
gpg(Oracle OSS group (Open Source Software group) &lt;build@oss.oracle.com&gt;
      Is it the case that the Oracle GPG Key is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_local_events_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to include local events, run the
following command:
$ sudo grep local_events /etc/audit/auditd.conf
The output should return the following:
local_events = yes
      Is it the case that local_events isn't set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_stackprotector_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STACKPROTECTOR /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_grpquota_question:question:1">
          <ocil:question_text>Verify the grpquota option is configured for the /home mount point,
    run the following command:
    $ sudo mount | grep '\s/home\s'
    . . . /home . . . grpquota . . .

      Is it the case that the "/home" file system does not have the "grpquota" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 use the "pam_pwhistory.so" module in the /etc/pam.d/password-auth file
and is configured to prohibit password reuse for a minimum of 
generations.

Verify the "/etc/pam.d/password-auth" file with the following command:

$ grep pam_pwhistory.so /etc/pam.d/password-auth
password  pam_pwhistory.so use_authtok remember=


Verify the "/etc/security/pwhistory.conf" file using the following command:

$ grep remember /etc/security/pwhistory.conf
remember = 

The pam_pwhistory.so "remember" option must be configured only in one file.
      Is it the case that the pam_pwhistory.so module is not used, the "remember" module option is not set in
/etc/pam.d/password-auth or in /etc/security/pwhistory.conf, or is set in both files, or is set
with a value less than "&lt;sub idref="var_password_pam_remember" /&gt;"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-server_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_postdrop_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "postdrop" command with the following command:

$ sudo auditctl -l | grep postdrop

-a always,exit -F path=/usr/bin/postdrop -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-postdrop
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_sudoers_d_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" with the following command:

$ sudo auditctl -l | grep/etc/sudoers.d

-w /etc/sudoers.d/ -p wa -k identity
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.forwarding kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.forwarding
0.
The ability to forward packets is only appropriate for routers.
      Is it the case that IP forwarding value is "1" and the system is not router?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit attempts to
alter time via the /etc/localtime file, run the following
command:
$ sudo auditctl -l | grep "watch=/etc/localtime"
If the system is configured to audit this activity, it will return a line.
      Is it the case that the system is not configured to audit time changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_forwarding_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.forwarding kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.forwarding
0.
The ability to forward packets is only appropriate for routers.
      Is it the case that IP forwarding value is "1" and the system is not router?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_fapolicyd_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the fapolicyd package is installed: $ rpm -q fapolicyd
      Is it the case that the fapolicyd package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
          <ocil:question_text>
To ensure the login warning banner text is properly set, run the following:
$ grep banner-message-text /etc/dconf/db/local.d/*
If properly configured, the proper banner text will appear.
To ensure the login warning banner text is locked and cannot be changed by a user, run the following:
$ grep banner-message-text /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-text.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_spectre_v2_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes spectre_v2=on,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*spectre_v2=on.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*spectre_v2=on.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'spectre_v2=on'
The command should not return any output.
      Is it the case that spectre_v2 mitigation is not enforced?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_source_route
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.autoconf kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.autoconf
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_vm_mmap_min_addr_question:question:1">
          <ocil:question_text>The runtime status of the vm.mmap_min_addr kernel parameter can be queried
by running the following command:
$ sysctl vm.mmap_min_addr
65536.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_ipsec_conf_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ipsec.conf,
run the command:
$ ls -l /etc/ipsec.conf
If properly configured, the output should indicate the following permissions:
0644
      Is it the case that /etc/ipsec.conf does not have unix mode 0644?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.tcp_syncookies kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.tcp_syncookies
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_gcc_plugin_structleak_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_GCC_PLUGIN_STRUCTLEAK /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_arm64_sw_ttbr0_pan_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_ARM64_SW_TTBR0_PAN /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the ipv6 on
network interfaces, it will contain a line of the form:
net.ipv6.conf.default.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory.
This permits insertion of the IPv6 kernel module (which other parts of the
system expect to be present), but otherwise keeps network interfaces
from using IPv6. Run the following command to search for such lines in all
files in /etc/sysctl.d:
$ grep -r ipv6 /etc/sysctl.d
      Is it the case that the ipv6 support is disabled by default on network interfaces?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_srv_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /srv mount point,
    run the following command:
    $ sudo mount | grep '\s/srv\s'
    . . . /srv . . . nosuid . . .

      Is it the case that the "/srv" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
          <ocil:question_text>To ensure the user list is disabled, run the following command:
$ grep disable-user-list /etc/dconf/db/local.d/*
The output should be true.
To ensure that users cannot enable displaying the user list, run the following:
$ grep disable-user-list /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-user-list
      Is it the case that disable-user-list has not been configured or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_ia32_emulation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_IA32_EMULATION /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_disable_recovery_question:question:1">
          <ocil:question_text>Verify that GRUB_DISABLE_RECOVERY is set to true in /etc/default/grub to disable recovery boot.
Run the following command:

$ sudo grep GRUB_DISABLE_RECOVERY /etc/default/grub
      Is it the case that GRUB_DISABLE_RECOVERY is not set to true or is missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_nolisten_question:question:1">
          <ocil:question_text>Verify that the system is not accepting "rsyslog" messages from other systems unless it is
documented as a log aggregation server.
Display the contents of the rsyslog configuration files:
find /etc -maxdepth 2 -regex '/etc/rsyslog\(\.conf\|\.d\/.*\.conf\)' -exec cat '{}' \;

If any of the below lines are found, ask to see the documentation for the system being used
for log aggregation:

If using legacy syntax:
$ModLoad imtcp
$InputTCPServerRun port
$ModLoad imudp
$UDPServerRun port
$ModLoad imrelp
$InputRELPServerRun port

If using RainerScript syntax:
module(load="imtcp")
module(load="imudp")
input(type="imtcp" port="514")
input(type="imudp" port="514")

      Is it the case that rsyslog accepts remote messages and is not documented as a log aggregation system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_unique_name_question:question:1">
          <ocil:question_text>To verify all accounts have unique names, run the following command:
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
No output should be returned.
      Is it the case that a line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_cron_weekly_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/cron.weekly,
run the command:
$ ls -lL /etc/cron.weekly
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/cron.weekly does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_smartcard_packages_question:question:1">
          <ocil:question_text>Check that Oracle Linux 9 has the packages for smart card support installed.

Run the following command to determine if the openssl-pkcs11 package is installed:
$ rpm -q openssl-pkcs11
      Is it the case that smartcard software is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_ciphers_opensshserver_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH server uses defined ciphers in the Crypto Policy, run:
$ grep -Po '(-oCiphers=\S+)' /etc/crypto-policies/back-ends/opensshserver.config
and verify that the line matches:
-oCiphers=
      Is it the case that Crypto Policy for OpenSSH Server is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_grub2_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_pti_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes pti=on,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*pti=on.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*pti=on.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'pti=on'
The command should not return any output.
      Is it the case that Kernel page-table isolation is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_netrc_files_question:question:1">
          <ocil:question_text>To check the system for the existence of any .netrc files,
run the following command:
$ sudo find /home -xdev -name .netrc
      Is it the case that any .netrc files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_tallylog_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/tallylog" with the following command:

$ sudo auditctl -l | grep /var/log/tallylog

-w /var/log/tallylog -p wa -k logins
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_group_ownership_var_log_audit_question:question:1">
          <ocil:question_text>
Determine the audit log group by running the following command:

$ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf

Then, check that all directories within the /var/log/audit directory are owned by the group specified as log_group or by root if the log_group is not specified.
Run the following command:

$ sudo find /var/log/audit -type d -printf "%p %g\n"

All listed directories must be owned by the log_group or by root if the log_group is not specified.
      Is it the case that there is a directory owned by different group?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_home_directories_question:question:1">
          <ocil:question_text>To verify the assigned home directory of all interactive user home directories
have a mode of 0750 or less permissive, run the following command:
$ sudo ls -l /home
Inspect the output for any directories with incorrect permissions.
      Is it the case that they are more permissive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nss-tools_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nss-tools package is installed: $ rpm -q nss-tools
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_at_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_sshd_private_key_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/ssh/*_key,
run the command:
$ ls -lL /etc/ssh/*_key
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/ssh/*_key does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_sshd_disabled_question:question:1">
          <ocil:question_text>To check that the sshd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled sshd
Output should indicate the sshd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled sshd disabled

Run the following command to verify sshd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active sshd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the sshd is masked, run the following command:
$ sudo systemctl show sshd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "sshd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_polyinstantiated_var_tmp_question:question:1">
          <ocil:question_text>Run the following command to ensure that /var/tmp is configured as a
polyinstantiated directory:
$ sudo grep /var/tmp /etc/security/namespace.conf
The output should return the following:
/var/tmp /var/tmp/tmp-inst/    level      root,adm
      Is it the case that is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_daily_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.daily,
run the command:
$ ls -lL /etc/cron.daily
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.daily does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-timer_logrotate_enabled_question:question:1">
          <ocil:question_text> Run the following command to determine the current status of the logrotate timer: $ sudo systemctl is-active logrotate.timer If the timer is running, it should return the following: active
      Is it the case that logrotate timer is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_home_directories_question:question:1">
          <ocil:question_text>To verify the assigned home directory of all interactive users is group-
owned by that users primary GID, run the following command:
# ls -ld $(awk -F: '($3&gt;=1000)&amp;&amp;($7 !~ /nologin/){print $6}' /etc/passwd)
      Is it the case that the group ownership is incorrect?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_iptables_default_rule_question:question:1">
          <ocil:question_text>Inspect the file /etc/sysconfig/iptables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/iptables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_rsh_trust_files_question:question:1">
          <ocil:question_text>The existence of the file /etc/hosts.equiv or a file named
.rhosts inside a user home directory indicates the presence
of an Rsh trust relationship.
      Is it the case that these files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
          <ocil:question_text>To find world-writable directories that lack the sticky bit, run the following command:
$ sudo find / -type d \( -perm -0002 -a ! -perm -1000 \) -print 2&gt;/dev/null
fixtext: |-
Configure all world-writable directories to have the sticky bit set to prevent unauthorized and unintended information transferred via shared system resources.

Set the sticky bit on all world-writable directories using the command, replace "[World-Writable Directory]" with any directory path missing the sticky bit:

$ chmod a+t [World-Writable Directory]
srg_requirement:
A sticky bit must be set on all Oracle Linux 9 public directories to prevent unauthorized and unintended information transferred via shared system resources.
      Is it the case that any world-writable directories are missing the sticky bit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.autoconf kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.autoconf
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_table_isolation_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_TABLE_ISOLATION /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_kmod_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "kmod" command with the following command:

$ sudo auditctl -l | grep kmod

-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-kmod
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_telnet-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the telnet-server package is installed:
$ rpm -q telnet-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_owner_etc_selinux_question:question:1">
          <ocil:question_text>To check the ownership of /etc/selinux,
run the command:
$ ls -lL /etc/selinux
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/selinux does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openscap-scanner_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openscap-scanner package is installed: $ rpm -q openscap-scanner
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_logon_fail_delay_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 enforces a delay of at least  seconds between console logon prompts following a failed logon attempt with the following command:

$ sudo grep -i "FAIL_DELAY" /etc/login.defs
FAIL_DELAY 
      Is it the case that the value of "FAIL_DELAY" is not set to "&lt;sub idref="var_accounts_fail_delay" /&gt;" or greater, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_delete_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_shadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shadow,
run the command:
$ ls -lL /etc/shadow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shadow does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_crypttab_question:question:1">
          <ocil:question_text>To check the ownership of /etc/crypttab,
run the command:
$ ls -lL /etc/crypttab
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/crypttab does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_chrony_keys_question:question:1">
          <ocil:question_text>To check the permissions of /etc/chrony.keys,
run the command:
$ ls -l /etc/chrony.keys
If properly configured, the output should indicate the following permissions:
0640
      Is it the case that /etc/chrony.keys does not have unix mode 0640?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_permissions_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable,
run the following command for each directory DIR which contains shared libraries:
$ sudo find -L DIR -perm /022 -type d
      Is it the case that any of these files are group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_atd_disabled_question:question:1">
          <ocil:question_text>To check that the atd service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled atd
Output should indicate the atd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled atd disabled

Run the following command to verify atd is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active atd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the atd is masked, run the following command:
$ sudo systemctl show atd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "atd" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_sudoers_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" with the following command:

$ sudo auditctl -l | grep /etc/sudoers

-w /etc/sudoers -p wa -k identity
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_stackprotector_strong_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_STACKPROTECTOR_STRONG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_firewalld_ports_question:question:1">
          <ocil:question_text>Inspect the list of enabled firewall ports and verify they are configured correctly by running
the following command:

$ sudo firewall-cmd --list-all

Ask the System Administrator for the site or program Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA). Verify the services allowed by the firewall match the PPSM CLSA.
      Is it the case that there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), or there are no firewall rules configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_policycoreutils-python-utils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the policycoreutils-python-utils package is installed: $ rpm -q policycoreutils-python-utils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_use_fips_hashes_question:question:1">
          <ocil:question_text>To determine that AIDE is configured for FIPS 140-2 file hashing, run the following command:
$ grep sha512 /etc/aide.conf
Verify that the sha512 option is added to the correct ruleset.
      Is it the case that the sha512 option is missing or not added to the correct ruleset?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_host_based_files_question:question:1">
          <ocil:question_text>Verify that there are no shosts.equiv files on the system, run the following command:
$ find / -name shosts.equiv
      Is it the case that shosts.equiv files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_nosmap_argument_absent_question:question:1">
          <ocil:question_text>Make sure that the kernel is not disabling SMAP with the following
commands.
grep -q nosmap /boot/config-`uname -r`
If the command returns a line, it means that SMAP is being disabled.
      Is it the case that the kernel is configured to disable SMAP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_iptables_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
iptables service:
$ sudo systemctl is-active iptables
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_can_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the can kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the can kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r can /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_refcount_full_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_REFCOUNT_FULL /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rsyslog_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
rsyslog service:
$ sudo systemctl is-active rsyslog
If the service is running, it should return the following: active
      Is it the case that the "rsyslog" service is disabled, masked, or not started.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-restrict_serial_port_logins_question:question:1">
          <ocil:question_text>To check for serial port entries which permit root login,
run the following command:
$ sudo grep ^ttyS/[0-9] /etc/securetty
If any output is returned, then root login over serial ports is permitted.
      Is it the case that root login over serial ports is permitted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_overflow_action_question:question:1">
          <ocil:question_text>Verify the audit system is configured to take an appropriate action when the internal event queue is full:
$ sudo grep -i overflow_action /etc/audit/auditd.conf

The output should contain overflow_action = syslog

If the value of the "overflow_action" option is not set to syslog,
single, halt or the line is commented out, ask the System Administrator
to indicate how the audit logs are off-loaded to a different system or media.
      Is it the case that auditd overflow action is not set correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_su_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "su" command with the following command:

$ sudo auditctl -l | grep su

-a always,exit -F path=/usr/bin/su -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-su
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
          <ocil:question_text>To ensure only SNMPv3 or newer is used, run the following command:
$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"
There should be no output.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_owner_etc_sudoersd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/sudoers.d,
run the command:
$ ls -lL /etc/sudoers.d
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/sudoers.d does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
          <ocil:question_text>To obtain a list of all users and the content of their shadow password field, run the command:
$ sudo readarray -t systemaccounts 
Verify if all accounts are locked.
      Is it the case that system accounts are not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_print_last_log_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PrintLastLog option is set, run the following command:

$ sudo grep -i PrintLastLog /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nosuid_remote_filesystems_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for all NFS mounts, run
the following command:
$ mount | grep nfs
All NFS mounts should show the nosuid setting in parentheses. This
is not applicable if NFS is not implemented.
      Is it the case that the setting does not show?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_ownership_binary_dirs_question:question:1">
          <ocil:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/local/bin
/usr/local/sbin
/usr/sbin
For each of these directories, run the following command to find files
not owned by root:
$ sudo find -L DIR/ ! -user root -type d -exec chown root {} \;
      Is it the case that any system executables directories are found to not be owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_rtr_pref kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_rtr_pref
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ssh_client_rekey_limit_question:question:1">
          <ocil:question_text>To check if RekeyLimit is set correctly, run the following command:
$ sudo grep RekeyLimit /etc/ssh/ssh_config.d/*.conf
If configured properly, output should be
/etc/ssh/ssh_config.d/02-rekey-limit.conf:
RekeyLimit  
Check also the main configuration file with the following command:
$ sudo grep RekeyLimit /etc/ssh/ssh_config
The command should not return any output.
      Is it the case that it is commented out or is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_ssh_crypto_policy_question:question:1">
          <ocil:question_text>Verify that sshd isn't configured to ignore the system wide cryptographic policy.

Check that the CRYPTO_POLICY variable is not set or is commented out in the
/etc/sysconfig/sshd.

Run the following command:

$ sudo grep CRYPTO_POLICY /etc/sysconfig/sshd
      Is it the case that the CRYPTO_POLICY variable is set or is not commented out in the /etc/sysconfig/sshd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_immutable_question:question:1">
          <ocil:question_text>Verify the audit system prevents unauthorized changes with the following command:

$ sudo grep "^\s*[^#]" /etc/audit/audit.rules | tail -1
-e 2

      Is it the case that the audit system is not set to be immutable by adding the "-e 2" option to the end of "/etc/audit/audit.rules"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_pam_services_question:question:1">
          <ocil:question_text>To verify that SSSD is configured for PAM services, run the following command:
$ sudo grep services /etc/sssd/sssd.conf
If configured properly, output should be similar to
services = pam
      Is it the case that it does not exist or 'pam' is not added to the 'services' option under the 'sssd' section?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
          <ocil:question_text>To check the minimum password length, run the command:
$ grep PASS_MIN_LEN /etc/login.defs
The DoD requirement is 15.
      Is it the case that it is not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_at_allow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/at.allow,
run the command:
$ ls -l /etc/at.allow
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/at.allow does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_crypttab_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/crypttab,
run the command:
$ ls -lL /etc/crypttab
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/crypttab does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slab_freelist_hardened_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLAB_FREELIST_HARDENED /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_panic_on_oops_question:question:1">
          <ocil:question_text>The runtime status of the kernel.panic_on_oops kernel parameter can be queried
by running the following command:
$ sysctl kernel.panic_on_oops
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
          <ocil:question_text>Run the following command to ensure the default FORWARD policy is DROP:
grep ":FORWARD" /etc/sysconfig/iptables
The output should be similar to the following:
$ sudo grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0
      Is it the case that the default policy for the FORWARD chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_bug_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_BUG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shadow,
run the command:
$ ls -lL /etc/shadow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shadow does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_xdmcp_question:question:1">
          <ocil:question_text>To ensure that XDMCP is disabled in /etc/gdm/custom.conf, run the following command:
grep -Pzo "\[xdmcp\]\nEnable=false" /etc/gdm/custom.conf
The output should return the following:

[xdmcp]
Enable=false

      Is it the case that the Enable is not set to false or is missing in the xdmcp section of the /etc/gdm/custom.conf gdm configuration file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_keepalive_0_question:question:1">
          <ocil:question_text>To ensure ClientAliveInterval is set correctly, run the following command:

$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config

If properly configured, the output should be:
ClientAliveCountMax 0

In this case, the SSH timeout occurs precisely when
the ClientAliveInterval is set.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rdisc_disabled_question:question:1">
          <ocil:question_text>To check that the rdisc service is disabled in system boot configuration,
run the following command:
$ sudo systemctl is-enabled rdisc
Output should indicate the rdisc service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ sudo systemctl is-enabled rdisc disabled

Run the following command to verify rdisc is not active (i.e. not running) through current runtime configuration:
$ sudo systemctl is-active rdisc

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the rdisc is masked, run the following command:
$ sudo systemctl show rdisc | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the "rdisc" is loaded and not masked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_enforce_root_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces password complexity rules for the root account.

Check if root user is required to use complex passwords with the following command:

$ grep enforce_for_root /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

/etc/security/pwquality.conf:enforce_for_root
      Is it the case that "enforce_for_root" is commented or missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tuned_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tuned package is installed:
$ rpm -q tuned
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_motd_question:question:1">
          <ocil:question_text>To check if the system motd banner is compliant,
run the following command:
$ cat /etc/motd
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_audit_auditd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/audit/auditd.conf,
run the command:
$ ls -l /etc/audit/auditd.conf
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/audit/auditd.conf does not have unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-bios_enable_execution_restrictions_question:question:1">
          <ocil:question_text>Verify the NX (no-execution) bit flag is set on the system.

Check that the no-execution bit flag is set with the following commands:

$ sudo dmesg | grep NX

[ 0.000000] NX (Execute Disable) protection: active

If "dmesg" does not show "NX (Execute Disable) protection" active, check the cpuinfo settings with the following command:

$ sudo grep flags /proc/cpuinfo
flags : fpu vme de pse tsc ms nx rdtscp lm constant_ts

The output should contain the "nx" flag.
      Is it the case that NX is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_periodic_cron_checking_question:question:1">
          <ocil:question_text>Verify the operating system routinely checks the baseline configuration for unauthorized changes.

To determine that periodic AIDE execution has been scheduled, run the following command:
$ grep aide /etc/crontab
The output should return something similar to the following:
05 4 * * * root /usr/sbin/aide --check

NOTE: The usage of special cron times, such as @daily or @weekly, is acceptable.
      Is it the case that AIDE is not configured to scan periodically?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_unique_id_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 contains no duplicate User IDs (UIDs) for interactive users.

Check that the operating system contains no duplicate UIDs for interactive users with the following command:

$ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd
      Is it the case that output is produced and the accounts listed are interactive user accounts?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_bind_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the bind package is installed:
$ rpm -q bind
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_dev_shm_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /dev/shm with the following command:

$ mountpoint /dev/shm

      Is it the case that "/dev/shm is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_modify_ldt_syscall_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_MODIFY_LDT_SYSCALL /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_setfiles_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "setfiles" command with the following command:

$ sudo auditctl -l | grep setfiles

-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-unix-update
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_auditadm_exec_content_question:question:1">
          <ocil:question_text>
Run the following command to determine if the auditadm_exec_content SELinux boolean is enabled:
$ getsebool auditadm_exec_content
If properly configured, the output should show the following:
auditadm_exec_content --&gt; on
      Is it the case that auditadm_exec_content is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_mcafeetp_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the McAfeeTP package is installed: $ rpm -q McAfeeTP
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-libreswan_approved_tunnels_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 does not have unauthorized IP tunnels configured.


# yum list installed libreswan
libreswan.x86-64 3.20-5.el7_4


If "libreswan" is installed, check to see if the "IPsec" service is active with the following command:

# systemctl status ipsec
ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)
Active: inactive (dead)


If the "IPsec" service is active, check for configured IPsec connections (conn), perform the following:
grep -rni conn /etc/ipsec.conf /etc/ipsec.d/
Verify any returned results for organizational approval.
      Is it the case that the IPSec tunnels are not approved?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
          <ocil:question_text>To ensure the screensaver is configured to be blank, run the following command:
$ gsettings get org.gnome.desktop.screensaver picture-uri
If properly configured, the output should be ''.

To ensure that users cannot set the screensaver background, run the following:
$ grep picture-uri /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/picture-uri
      Is it the case that it is not set or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gssproxy_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the gssproxy package is installed:
$ rpm -q gssproxy
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-networkmanager_dns_mode_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 has a DNS mode configured in Network Manager.

$ NetworkManager --print-config
[main]
dns=
      Is it the case that the dns key under main does not exist or is not set to "none" or "default"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_opt_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /opt mount point,
    run the following command:
    $ sudo mount | grep '\s/opt\s'
    . . . /opt . . . nosuid . . .

      Is it the case that the "/opt" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
          <ocil:question_text>To ensure write permissions are disabled for group and other
 for each element in root's path, run the following command:
# ls -ld DIR
      Is it the case that group or other write permissions exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 is configured to lock an account until released by an administrator
after  unsuccessful logon
attempts with the command:

$ grep 'unlock_time =' /etc/security/faillock.conf
unlock_time = 
      Is it the case that the "unlock_time" option is not set to "&lt;sub idref="var_accounts_passwords_pam_faillock_unlock_time" /&gt;",
the line is missing, or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_security_yama_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SECURITY_YAMA /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_openssl_crypto_policy_question:question:1">
          <ocil:question_text>To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file
/etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the
.include = /etc/crypto-policies/back-ends/opensslcnf.config directive:

$ sudo grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
      Is it the case that the OpenSSL config file doesn't contain the whole section,
or the section doesn't contain the &lt;pre&gt;.include = /etc/crypto-policies/back-ends/opensslcnf.config&lt;/pre&gt; directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_ownership_var_log_audit_question:question:1">
          <ocil:question_text>Determine where the audit logs are stored with the following command:

$ sudo grep -iw log_file /etc/audit/auditd.conf

log_file = /var/log/audit/audit.log

Determine the owner of the audit log directory by using the output of the above command
(default: "/var/log/audit/"). Run the following command with the correct audit log directory
path:

$ sudo ls -ld /var/log/audit

drwx------ 2 root root 23 Jun 11 11:56 /var/log/audit

The audit log directory must be owned by "root"
      Is it the case that the directory is not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_user_dot_user_ownership_question:question:1">
          <ocil:question_text>To verify all local initialization files for interactive users are owned by the
primary user, run the following command:
$ sudo ls -al /home/USER/.*
The user initialization files should be owned by USER.
      Is it the case that they are not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_kerberos_crypto_policy_question:question:1">
          <ocil:question_text>Check that the symlink exists and target the correct Kerberos crypto policy, with the following command:
file /etc/krb5.conf.d/crypto-policies
If command ouput shows the following line, Kerberos is configured to use the system-wide crypto policy.
/etc/krb5.conf.d/crypto-policies: symbolic link to /etc/crypto-policies/back-ends/krb5.config
      Is it the case that the symlink does not exist or points to a different target?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.drop_gratuitous_arp kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.drop_gratuitous_arp
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_verify_acls_question:question:1">
          <ocil:question_text>To determine that AIDE is verifying ACLs, run the following command:
$ grep acl /etc/aide.conf
Verify that the acl option is added to the correct ruleset.
      Is it the case that the acl option is missing or not added to the correct ruleset?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_audit_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes audit=1,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*audit=1.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*audit=1.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'audit=1'
The command should not return any output.
      Is it the case that auditing is not enabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_issue_question:question:1">
          <ocil:question_text>To check if the system login banner is compliant,
run the following command:

$ cat /etc/issue
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_atm_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the atm kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the atm kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r atm /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_tls_cacert_question:question:1">
          <ocil:question_text>To verify that rsyslog's Forwarding Output Module has CA certificate
configured for its TLS connections to remote server, run the following command:
$ grep DefaultNetstreamDriverCAFile /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include record similar to
global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")
where the path to the CA file (/etc/pki/tls/cert.pem in case above) must point to the correct CA certificate.
      Is it the case that CA certificate for rsyslog remote logging via TLS is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
          <ocil:question_text>To verify that the audit system collects unauthorized file accesses, run the following commands:
$ sudo grep EACCES /etc/audit/audit.rules
$ sudo grep EPERM /etc/audit/audit.rules
      Is it the case that 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_perm_change_failed_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-5-perm-change-failed.rules
The output has to be exactly as follows:
## Unsuccessful permission change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=unsuccessful-perm-change    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.kexec_load_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.kexec_load_disabled
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_bashrc_question:question:1">
          <ocil:question_text>Verify the umask setting is configured correctly in the /etc/bashrc file with the following command:

$ sudo grep "umask" /etc/bashrc

umask 
      Is it the case that the value for the "umask" parameter is not "&lt;sub idref="var_accounts_user_umask" /&gt;", or the "umask" parameter is missing or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_root_gid_zero_question:question:1">
          <ocil:question_text>To verify that root's primary group is zero run the following command:

    grep '^root:' /etc/passwd | cut -d : -f 4

The command should return:

0

      Is it the case that root has a primary gid not equal to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured correctly:
space_left SIZE_in_MB
      Is it the case that the system is not configured a specfic size in MB to notify administrators of an issue?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tftp_removed_question:question:1">
          <ocil:question_text>The tftp package can be removed with the following command:  $ sudo yum erase tftp
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
          <ocil:question_text>To check which SSH protocol version is allowed, check version of
openssh-server with following command:
$ rpm -qi openssh-server | grep Version
Versions equal to or higher than 7.4 have deprecated the RhostsRSAAuthentication option.
If version is lower than 7.4, run the following command to check configuration:
To determine how the SSH daemon's RhostsRSAAuthentication option is set, run the following command:

$ sudo grep -i RhostsRSAAuthentication /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_cron_daily_question:question:1">
          <ocil:question_text>To check the permissions of /etc/cron.daily,
run the command:
$ ls -l /etc/cron.daily
If properly configured, the output should indicate the following permissions:
-rwx------
      Is it the case that /etc/cron.daily does not have unix mode -rwx------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.send_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_question:question:1">
          <ocil:question_text>To verify whether audispd plugin off-loads audit records onto a different
system or media from the system being audited, run the following command:

$ sudo grep -i remote_server /etc/audit/audisp-remote.conf

The output should return something similar to where REMOTE_SYSTEM
is an IP address or hostname:
remote_server = REMOTE_SYSTEM

Determine which partition the audit records are being written to with the
following command:

$ sudo grep log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Check the size of the partition that audit records are written to with the
following command and verify whether it is sufficiently large:

$ sudo df -h /var/log/audit/
/dev/sda2 24G 10.4G 13.6G 43% /var/log/audit
      Is it the case that audispd is not sending logs to a remote system and the local partition has inadequate space?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_system_commands_dirs_question:question:1">
          <ocil:question_text>Verify the system commands contained in the following directories are group-owned by "root", or a required system account, with the following command:

$ sudo find -L /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin ! -group root -exec ls -l {} \;
      Is it the case that any system commands are returned and is not group-owned by a required system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_dovecot_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the dovecot package is installed:
$ rpm -q dovecot
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_group_question:question:1">
          <ocil:question_text>To check the permissions of /etc/group,
run the command:
$ ls -l /etc/group
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group does not have unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_access_monitoring_question:question:1">
          <ocil:question_text>To verify that remote access methods are logging to rsyslog,
run the following command:
grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.*
The output should contain auth.*, authpriv.*, and daemon.*
pointing to a log file.
      Is it the case that remote access methods are not logging to rsyslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_system_commands_group_root_owned_question:question:1">
          <ocil:question_text>System commands are stored in the following directories:
/bin 
/sbin 
/usr/bin 
/usr/sbin 
/usr/local/bin 
/usr/local/sbin
For each of these directories, run the following command to find directories not
owned by root:
$ sudo find -L $DIR ! -group root -type d -exec chgrp root {} \;
      Is it the case that any of these directories are not group owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_owner_etc_iptables_question:question:1">
          <ocil:question_text>To check the ownership of /etc/iptables,
run the command:
$ ls -lL /etc/iptables
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/iptables does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
          <ocil:question_text>The runtime status of the fs.suid_dumpable kernel parameter can be queried
by running the following command:
$ sysctl fs.suid_dumpable
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_audit_configuration_question:question:1">
          <ocil:question_text>
To properly set the group owner of /etc/audit/, run the command:
$ sudo chgrp root /etc/audit/

To properly set the group owner of /etc/audit/rules.d/, run the command:
$ sudo chgrp root /etc/audit/rules.d/
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's KerberosAuthentication option is set, run the following command:

$ sudo grep -i KerberosAuthentication /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coredump_disable_storage_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 disables storing core dumps for all users by issuing the following command:

$ grep -i storage /etc/systemd/coredump.conf

Storage=none
      Is it the case that Storage is not set to none or is commented out and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement for all domains that have the "core" item assigned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_route_localnet_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.route_localnet kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.route_localnet
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_chage_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "chage" command with the following command:

$ sudo auditctl -l | grep chage

-a always,exit -F path=/usr/bin/chage -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-chage
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to disable the
ipv6 kernel module, it will contain a line
of the form:
options ipv6 disable=1
Such lines may be inside any file in /etc/modprobe.d or the
deprecated/etc/modprobe.conf.  This permits insertion of the IPv6
kernel module (which other parts of the system expect to be present), but
otherwise keeps it inactive.  Run the following command to search for such
lines in all files in /etc/modprobe.d and the deprecated
/etc/modprobe.conf:
$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d
      Is it the case that the ipv6 kernel module is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.ip_local_port_range kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_local_port_range
32768 65535.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rngd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
rngd service:
$ sudo systemctl is-active rngd
If the service is running, it should return the following: active
      Is it the case that the "rngd" service is disabled, masked, or not started.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_sssd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
sssd service:
$ sudo systemctl is-active sssd
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the tipc kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the tipc kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r tipc /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_audit_question:question:1">
          <ocil:question_text>Verify the "/etc/security/faillock.conf" file is configured to log user name information when unsuccessful logon attempts occur:

$ sudo grep audit /etc/security/faillock.conf

audit
      Is it the case that the "audit" option is not set, is missing or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 is configured to lock an account after 
unsuccessful logon attempts with the command:

$ grep 'deny =' /etc/security/faillock.conf
deny = .
      Is it the case that the "deny" option is not set to "&lt;sub idref="var_accounts_passwords_pam_faillock_deny" /&gt;"
or less (but not "0"), is missing or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_user_host_based_files_question:question:1">
          <ocil:question_text>To verify that there are no .shosts files
on the system, run the following command:
$ sudo find / -name '.shosts'
      Is it the case that .shosts files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_setfacl_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "setfacl" command with the following command:

$ sudo auditctl -l | grep setfacl

-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid&gt;=1000 -F auid!=unset -k perm_mod
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_echo_ignore_broadcasts
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coredump_disable_backtraces_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 disables core dump backtraces by issuing the following command:

$ grep -i process /etc/systemd/coredump.conf

ProcessSizeMax=0
      Is it the case that the "ProcessSizeMax" item is missing, commented out, or the value is anything other than "0" and the need for core dumps is not documented with the Information System Security Officer (ISSO) as an operational requirement for all domains that have the "core" item assigned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_immutable_login_uids_question:question:1">
          <ocil:question_text>To determine if the system is configured to make login UIDs immutable, run
one of the following commands.
If the auditd daemon is configured to use the
augenrules program to read audit rules during daemon startup (the
default), run the following:
sudo grep immutable /etc/audit/rules.d/*.rules
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, run the following command:
sudo grep immutable /etc/audit/audit.rules
The following line should be returned:
--loginuid-immutable
      Is it the case that the system is not configured to make login UIDs immutable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
          <ocil:question_text>The runtime status of the kernel.kptr_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.kptr_restrict
The output of the command should indicate either:
kernel.kptr_restrict = 1
or:
kernel.kptr_restrict = 2
The output of the command should not indicate:
kernel.kptr_restrict = 0

The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.kptr_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d
The command should not find any assignments other than:
kernel.kptr_restrict = 1
or:
kernel.kptr_restrict = 2

Conflicting assignments are not allowed.
      Is it the case that the kernel.kptr_restrict is not set to 1 or 2 or is configured to be 0?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_strictmodes_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's StrictModes option is set, run the following command:

$ sudo grep -i StrictModes /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_deny_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.deny,
run the command:
$ ls -lL /etc/cron.deny
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.deny does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_shared_media_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.shared_media kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.shared_media
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
          <ocil:question_text>To check the password warning age, run the command:
$ grep PASS_WARN_AGE /etc/login.defs
The DoD requirement is 7.
      Is it the case that it is not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-use_kerberos_security_all_exports_question:question:1">
          <ocil:question_text>To verify the sec option is configured for all NFS mounts, run the following command:
$ grep "sec=" /etc/exports
All configured NFS exports should show the sec=krb5:krb5i:krb5p setting in parentheses.
This is not applicable if NFS is not implemented.
      Is it the case that the setting is not configured, has the 'sys' option added, or does not have all Kerberos options added?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/passwd-,
run the command:
$ ls -lL /etc/passwd-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/passwd- does not have a group owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_tcp_rfc1337_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.tcp_rfc1337 kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.tcp_rfc1337
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nodev_remote_filesystems_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for all NFS mounts, run
the following command:
$ mount | grep nfs
All NFS mounts should show the nodev setting in parentheses. This
is not applicable if NFS is not implemented.
      Is it the case that the setting does not show?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
          <ocil:question_text>To determine whether yum has been configured to disable
gpgcheck for any repos,  inspect all files in
/etc/yum.repos.d and ensure the following does not appear in any
sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo.
      Is it the case that GPG checking is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_requiretty_question:question:1">
          <ocil:question_text>To determine if requiretty has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\brequiretty\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that requiretty is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_deny_execmem_question:question:1">
          <ocil:question_text>
Run the following command to get the current configured value for deny_execmem
SELinux boolean:
$ getsebool deny_execmem
The expected cofiguration is .
"on" means true, and "off" means false
      Is it the case that deny_execmem is not set as expected?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates an audit record for unsuccessful attempts to use the truncate system call.

If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command:

$ sudo grep -r truncate /etc/audit/rules.d

If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command:

$ sudo grep truncate /etc/audit/audit.rules

The output should be the following:

-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
          <ocil:question_text>To ensure the system is configured to ignore the Ctrl-Alt-Del sequence,
run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.media-keys logout
$ grep logout /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/media-keys/logout
      Is it the case that GNOME3 is configured to reboot when Ctrl-Alt-Del is pressed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_permissions_question:question:1">
          <ocil:question_text>The following command will list which files on the system have permissions different from what
is expected by the RPM database:
$ rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_sudo_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "sudo" command with the following command:

$ sudo auditctl -l | grep sudo

-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-sudo
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_mce_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes mce=0,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*mce=0.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*mce=0.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'mce=0'
The command should not return any output.
      Is it the case that MCE tolerance is not set to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rng-tools_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rng-tools package is installed: $ rpm -q rng-tools
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.rp_filter parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.rp_filter
The output of the command should indicate either:
net.ipv4.conf.all.rp_filter = 1
or:
net.ipv4.conf.all.rp_filter = 2
The output of the command should not indicate:
net.ipv4.conf.all.rp_filter = 0

The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent sysctl parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
The command should not find any assignments other than:
net.ipv4.conf.all.rp_filter = 1
or:
net.ipv4.conf.all.rp_filter = 2

Conflicting assignments are not allowed.
      Is it the case that the net.ipv4.conf.all.rp_filter is not set to 1 or 2 or is configured to be 0?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_rhosts_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's IgnoreRhosts option is set, run the following command:

$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_tmout_question:question:1">
          <ocil:question_text>Run the following command to ensure the TMOUT value is configured for all users
on the system:

$ sudo grep TMOUT /etc/profile /etc/profile.d/*.sh

The output should return the following:
TMOUT=
      Is it the case that value of TMOUT is not less than or equal to expected setting?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_loglevel_info_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's LogLevel option is set, run the following command:

$ sudo grep -i LogLevel /etc/ssh/sshd_config

If a line indicating INFO is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_owner_change_success_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-6-owner-change-success.rules
The output has to be exactly as follows:
## Successful ownership change
-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change
-a always,exit -F arch=b64 -S lchown,fchown,chown,fchownat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-owner-change    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_directory_configuration_question:question:1">
          <ocil:question_text>To determine whether the SSH server includes configuration files from the right directory, run the following command:
$ sudo grep -i '^Include' /etc/ssh/sshd_config
If a line Include /etc/ssh/sshd_config.d/*.conf is returned, then the configuration file inclusion is set correctly.
      Is it the case that you don't include other configuration files from the main configuration file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_opasswd_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command:

$ sudo auditctl -l | grep -E '(/etc/security/opasswd)'

-w /etc/security/opasswd -p wa -k identity
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_sestatus_conf_question:question:1">
          <ocil:question_text>To check the permissions of /etc/sestatus.conf,
run the command:
$ ls -l /etc/sestatus.conf
If properly configured, the output should indicate the following permissions:
0644
      Is it the case that /etc/sestatus.conf does not have unix mode 0644?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_verify_ext_attributes_question:question:1">
          <ocil:question_text>To determine that AIDE is verifying extended file attributes, run the following command:
$ grep xattrs /etc/aide.conf
Verify that the xattrs option is added to the correct ruleset.
      Is it the case that the xattrs option is missing or not added to the correct ruleset?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_set_min_life_existing_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 has configured the minimum time period between password changes for each user account is one day or greater with the following command:

$ sudo awk -F: '$4 &lt; 1 {print $1 " " $4}' /etc/shadow
      Is it the case that any results are returned that are not associated with a system account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
          <ocil:question_text>Verify that the SA and ISSO (at a minimum) are notified when the audit storage volume is full.

Check which action Oracle Linux 9 takes when the audit storage volume is full with the following command:

$ sudo grep max_log_file_action /etc/audit/auditd.conf
max_log_file_action = 
      Is it the case that the value of the "max_log_file_action" option is set to "ignore", "rotate", or "suspend", or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_crypto_policy_question:question:1">
          <ocil:question_text>To verify that cryptography policy has been configured correctly, run the
following command:
$ update-crypto-policies --show
The output should return .
Run the command to check if the policy is correctly applied:
$ update-crypto-policies --is-applied
The output should be The configured policy is applied.
Moreover, check if settings for selected crypto policy are as expected.
List all libraries for which it holds that their crypto policies do not have symbolic link in /etc/crypto-policies/back-ends.
$ ls -l /etc/crypto-policies/back-ends/ | grep '^[^l]' | tail -n +2 | awk -F' ' '{print $NF}' | awk -F'.' '{print $1}' | sort
Subsequently, check if matching libraries have drop in files in the /etc/crypto-policies/local.d directory.
$ ls /etc/crypto-policies/local.d/ | awk -F'-' '{print $1}' | uniq | sort
Outputs of two previous commands should match.
      Is it the case that cryptographic policy is not configured or is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_lastlog_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog" with the following command:

$ sudo auditctl -l | grep /var/log/lastlog

-w /var/log/lastlog -p wa -k logins
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_enable_iommu_force_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes iommu=force,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*iommu=force.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*iommu=force.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'iommu=force'
The command should not return any output.
      Is it the case that I/OMMU is not activated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_devkmem_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEVKMEM /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_server_directive_question:question:1">
          <ocil:question_text>Run the following command and verify that time sources are only configured with server directive:
# grep -E "^(server|pool)" /etc/chrony.conf
A line with the appropriate server should be returned, any line returned starting with pool is a finding.
      Is it the case that an authoritative remote time server is not configured or configured with pool directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_messages_question:question:1">
          <ocil:question_text>To check the permissions of /var/log/messages,
run the command:
$ ls -l /var/log/messages
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /var/log/messages does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 enforces 24 hours/one day as the minimum password lifetime for new user accounts.

Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" with the following command:

$ grep -i pass_min_days /etc/login.defs

PASS_MIN_DAYS 
      Is it the case that the "PASS_MIN_DAYS" parameter value is not "&lt;sub idref="var_accounts_minimum_age_login_defs" /&gt;" or greater, or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libreswan_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libreswan package is installed: $ rpm -q libreswan
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_systemd_debug-shell_argument_absent_question:question:1">
          <ocil:question_text>Ensure that debug-shell service is not enabled with the following command:
grep systemd\.debug-shell=1 /boot/grub2/grubenv /etc/default/grub
If the command returns a line, it means that debug-shell service is being enabled.
      Is it the case that the comand returns a line?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_nmcli_permissions_question:question:1">
          <ocil:question_text>Using a non-privileged account, verify that users cannot modify or change
network settings with the nmcli command with the following command:
$ nmcli general permissions
The output should contain the following:
PERMISSION                                                        VALUE
org.freedesktop.NetworkManager.enable-disable-network             auth
org.freedesktop.NetworkManager.enable-disable-wifi                auth
org.freedesktop.NetworkManager.enable-disable-wwan                auth
org.freedesktop.NetworkManager.enable-disable-wimax               auth
org.freedesktop.NetworkManager.sleep-wake                         auth
org.freedesktop.NetworkManager.network-control                    auth
org.freedesktop.NetworkManager.wifi.share.protected               auth
org.freedesktop.NetworkManager.wifi.share.open                    auth
org.freedesktop.NetworkManager.settings.modify.system             auth
org.freedesktop.NetworkManager.settings.modify.own                auth
org.freedesktop.NetworkManager.settings.modify.hostname           auth
org.freedesktop.NetworkManager.settings.modify.global-dns         auth
org.freedesktop.NetworkManager.reload                             auth
org.freedesktop.NetworkManager.checkpoint-rollback                auth
org.freedesktop.NetworkManager.enable-disable-statistics          auth
org.freedesktop.NetworkManager.enable-disable-connectivity-check  auth
org.freedesktop.NetworkManager.wifi.scan                          auth

      Is it the case that non-privileged users can modify or change network settings?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /boot mount point,
    run the following command:
    $ sudo mount | grep '\s/boot\s'
    . . . /boot . . . nodev . . .

      Is it the case that the "/boot" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces password complexity by requiring that at least one numeric character be used.

Check the value for "dcredit" with the following command:

$ sudo grep dcredit /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf

/etc/security/pwquality.conf:dcredit = 
      Is it the case that the value of "dcredit" is a positive number or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_pubkey_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PubkeyAuthentication option is set, run the following command:

$ sudo grep -i PubkeyAuthentication /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.secure_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_basic_configuration_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/10-base-config.rules
The output has to be exactly as follows:
## First rule - delete all
-D

## Increase the buffers to survive stress events.
## Make this bigger for busy systems
-b 8192

## This determine how long to wait in burst of events
--backlog_wait_time 60000

## Set failure mode to syslog
-f 1    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_nodev_question:question:1">
          <ocil:question_text>Verify the nodev option is configured for the /home mount point,
    run the following command:
    $ sudo mount | grep '\s/home\s'
    . . . /home . . . nodev . . .

      Is it the case that the "/home" file system does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
          <ocil:question_text>To check the status of the idle screen lock activation, run the following command:

$ gsettings get org.gnome.desktop.screensaver lock-enabled
If properly configured, the output should be true.
To ensure that users cannot change how long until the screensaver locks, run the following:
$ grep lock-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-enabled should be /org/gnome/desktop/screensaver/lock-enabled
      Is it the case that screensaver locking is not enabled and/or has not been set or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_page_poison_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes page_poison=1,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*page_poison=1.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*page_poison=1.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'page_poison=1'
The command should not return any output.
      Is it the case that page allocator poisoning is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_sudoedit_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "sudoedit" command with the following command:

$ sudo auditctl -l | grep sudoedit

-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-sudoedit
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_sctp_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the sctp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the sctp kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r sctp /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/etc/sudoers\|watch=/etc/sudoers.d\|-w /etc/sudoers\|-w /etc/sudoers.d"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_cron_d_question:question:1">
          <ocil:question_text>To check the ownership of /etc/cron.d,
run the command:
$ ls -lL /etc/cron.d
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/cron.d does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_specify_remote_server_question:question:1">
          <ocil:question_text>Run the following command and verify remote server is configured properly:
# grep -E "^(server|pool)" /etc/chrony.conf
      Is it the case that a remote time server is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_users_home_files_groupownership_question:question:1">
          <ocil:question_text>To verify all files and directories in interactive user home directory are
group-owned by a group the user is a member of, run the
following command:
$ sudo ls -lLR /home/USER
      Is it the case that the group ownership is incorrect?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_password_selinux_faillock_dir_question:question:1">
          <ocil:question_text>If the system does not have SELinux enabled and enforcing a targeted policy, or if the
pam_faillock.so module is not configured for use, this requirement is not applicable.

Verify the location of the non-default tally directory for the pam_faillock.so module with
the following command:

$ sudo grep -w dir /etc/security/faillock.conf

dir = /var/log/faillock

Check the security context type of the non-default tally directory with the following command:

$ sudo ls -Zd /var/log/faillock

unconfined_u:object_r:faillog_t:s0 /var/log/faillock
      Is it the case that the security context type of the non-default tally directory is not "faillog_t"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_shells_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shells,
run the command:
$ ls -lL /etc/shells
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shells does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_all_shadowed_sha512_question:question:1">
          <ocil:question_text>Verify that the interactive user account passwords are using a strong
password hash with the following command:

$ sudo cut -d: -f2 /etc/shadow

$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

Password hashes ! or * indicate inactive accounts not
available for logon and are not evaluated.
      Is it the case that any interactive user password hash does not begin with "$6"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
          <ocil:question_text>To verify that automatic logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\nautomaticlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
AutomaticLoginEnable=false
      Is it the case that GDM allows users to automatically login?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 enforces a -day maximum password lifetime for new user accounts by running the following command:

$ grep -i pass_max_days /etc/login.defs

PASS_MAX_DAYS 
      Is it the case that the "PASS_MAX_DAYS" parameter value is greater than "&lt;sub idref="var_accounts_maximum_age_login_defs" /&gt;", or commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_no_command_negation_question:question:1">
          <ocil:question_text>To determine if negation is used to define commands users are allowed to execute using sudo, run the following command:
$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*' /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that /etc/sudoers file contains rules that define the set of allowed commands using negation?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_slub_debug_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_SLUB_DEBUG /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_disable_interactive_boot_question:question:1">
          <ocil:question_text>Inspect /etc/default/grub for any instances of
systemd.confirm_spawn=(1|yes|true|on) in the kernel boot arguments.
Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates
that interactive boot is enabled at boot time and verify that
GRUB_DISABLE_RECOVERY=true to disable recovery boot.
      Is it the case that Interactive boot is enabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_user_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/user.cfg,
run the command:
$ ls -l /boot/grub2/user.cfg
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that /boot/grub2/user.cfg does not have unix mode -rw-------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_shadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shadow,
run the command:
$ ls -l /etc/shadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/shadow does not have unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_delete_success_question:question:1">
          <ocil:question_text>To verify that the Audit is correctly configured according to recommended rules, check the content of the file with the following command:
cat /etc/audit/rules.d/30-ospp-v42-4-delete-success.rules
The output has to be exactly as follows:
## Successful file delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F success=1 -F auid&gt;=1000 -F auid!=unset -F key=successful-delete    
      Is it the case that the file does not exist or the content differs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_iprutils_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the iprutils package is installed:
$ rpm -q iprutils
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_event_max_sample_rate kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_event_max_sample_rate
1.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_opensc_card_drivers_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 loads the  driver with the following command:

$ grep card_drivers /etc/opensc.conf

card_drivers = ;
      Is it the case that "&lt;sub idref="var_smartcard_drivers" /&gt;" is not listed as a card driver, or there is no line returned for "card_drivers"?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_source_route
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_set_post_pw_existing_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 's INACTIVE conforms to site policy (no more than 30 days) with the following command:

$ sudo awk -F: '$7 &gt; 30 {print $1 " " $7}' /etc/shadow
      Is it the case that the value of INACTIVE is greater than the expected value or is -1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_debug_fs_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_DEBUG_FS /boot/config.*
    
    Configs with value 'n' are not explicitly set in the file, so either commented lines or no
    lines should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/grub2/grub.cfg,
run the command:
$ ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/grub2/grub.cfg does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_restorecon_question:question:1">
          <ocil:question_text>Verify that Oracle Linux 9 is configured to audit the execution of the "restorecon" command with the following command:

$ sudo auditctl -l | grep restorecon

-a always,exit -F path=/usr/sbin/restorecon -F perm=x -F auid&gt;=1000 -F auid!=unset -k privileged-restorecon
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 generates an audit record for unsuccessful attempts to use the ftruncate system call.

If the auditd daemon is configured to use the "augenrules" program to to read audit rules during daemon startup (the default), run the following command:

$ sudo grep -r ftruncate /etc/audit/rules.d

If the auditd daemon is configured to use the "auditctl" utility to read audit rules during daemon startup, run the following command:

$ sudo grep ftruncate /etc/audit/audit.rules

The output should be the following:

-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -k access
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_setroubleshoot-plugins_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the setroubleshoot-plugins package is installed:
$ rpm -q setroubleshoot-plugins
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the dccp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated /etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/false) upon a module install event.

These lines can also instruct the module loading system to ignore the dccp kernel module via blacklist keyword.

Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_have_homedir_login_defs_question:question:1">
          <ocil:question_text>Verify all local interactive users on Oracle Linux 9 are assigned a home
directory upon creation with the following command:
$ grep -i create_home /etc/login.defs
CREATE_HOME yes
      Is it the case that the value for "CREATE_HOME" parameter is not set to "yes", the line is missing, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
          <ocil:question_text>To ensure the MaxAuthTries parameter is set, run the following command:
$ sudo grep MaxAuthTries /etc/ssh/sshd_config
If properly configured, output should be:
MaxAuthTries 
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nodev_removable_partitions_question:question:1">
          <ocil:question_text>Verify file systems that are used for removable media are mounted with the "nodev" option with the following command:

$ sudo more /etc/fstab

UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid,nodev,noexec 0 0
      Is it the case that a file system found in "/etc/fstab" refers to removable media and it does not have the "nodev" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_user_dot_group_ownership_question:question:1">
          <ocil:question_text>To verify the local initialization files of all local interactive users are group-
owned by the appropriate user, inspect the primary group of the respective
users in /etc/passwd and verify all initialization files under the
respective users home directory. Check the group owner of all local interactive users
initialization files.
      Is it the case that they are not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_owner_etc_nftables_question:question:1">
          <ocil:question_text>To check the ownership of /etc/nftables,
run the command:
$ ls -lL /etc/nftables
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/nftables does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shadow-,
run the command:
$ ls -lL /etc/shadow-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shadow- does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_config_page_poisoning_zero_question:question:1">
          <ocil:question_text>To determine the config value the kernel was built with, run the following command:
    $ grep CONFIG_PAGE_POISONING_ZERO /boot/config.*
    
    For each kernel installed, a line with value "y" should be returned.
    
      Is it the case that the kernel was not built with the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwquality_system_auth_question:question:1">
          <ocil:question_text>To check if pam_pwquality.so is enabled in system-auth, run the following command:
$ grep pam_pwquality /etc/pam.d/system-auth
The output should be similar to the following:
password requisite pam_pwquality.so
      Is it the case that pam_pwquality.so is not enabled in system-auth?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_retry_question:question:1">
          <ocil:question_text>Verify Oracle Linux 9 is configured to limit the "pwquality" retry option to .


Check for the use of the "pwquality" retry option in the pwquality.conf file with the following command:
$ grep retry /etc/security/pwquality.conf
      Is it the case that the value of "retry" is set to "0" or greater than "&lt;sub idref="var_password_pam_retry" /&gt;", or is missing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sebool_authlogin_radius_question:question:1">
          <ocil:question_text>
Run the following command to determine if the authlogin_radius SELinux boolean is disabled:
$ getsebool authlogin_radius
If properly configured, the output should show the following:
authlogin_radius --&gt; off
      Is it the case that authlogin_radius is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_owner_etc_sysctld_question:question:1">
          <ocil:question_text>To check the ownership of /etc/sysctl.d,
run the command:
$ ls -lL /etc/sysctl.d
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/sysctl.d does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-fapolicy_default_deny_question:question:1">
          <ocil:question_text>Verify the Oracle Linux 9 "fapolicyd" employs a deny-all, permit-by-exception policy.

Check that "fapolicyd" is in enforcement mode with the following command:

$ sudo grep permissive /etc/fapolicyd/fapolicyd.conf

permissive = 0

Check that fapolicyd employs a deny-all policy on system mounts with the following commands:
$ sudo tail /etc/fapolicyd/compiled.rules

allow exe=/usr/bin/python3.7 : ftype=text/x-python
deny_audit perm=any pattern=ld_so : all
deny perm=any all : all
      Is it the case that fapolicyd is not running in enforcement mode with a deny-all, permit-by-exception policy?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_nosuid_question:question:1">
          <ocil:question_text>Verify the nosuid option is configured for the /var/log mount point,
    run the following command:
    $ sudo mount | grep '\s/var/log\s'
    . . . /var/log . . . nosuid . . .

      Is it the case that the "/var/log" file system does not have the "nosuid" option set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_home_question:question:1">
          <ocil:question_text>Verify that a separate file system/partition has been created for /home with the following command:

$ mountpoint /home

      Is it the case that "/home is not a mountpoint" is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_krb_sec_remote_filesystems_question:question:1">
          <ocil:question_text>To verify the sec option is configured for all NFS mounts, run the following command:
$ mount | grep "sec="
All NFS mounts should show the sec=krb5:krb5i:krb5p setting in parentheses.
This is not applicable if NFS is not implemented.
      Is it the case that the setting is not configured, has the 'sys' option added, or does not have all Kerberos options added?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_spec_store_bypass_disable_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If it includes spec_store_bypass_disable=,
then the parameter will be configured for newly installed kernels.
First check if the GRUB recovery is enabled:
$ sudo grep 'GRUB_DISABLE_RECOVERY' /etc/default/grub
If this option is set to true, then check that a line is output by the following command:
$ sudo grep 'GRUB_CMDLINE_LINUX_DEFAULT.*spec_store_bypass_disable=.*' /etc/default/grub
If the recovery is disabled, check the line with
$ sudo grep 'GRUB_CMDLINE_LINUX.*spec_store_bypass_disable=.*' /etc/default/grub.Moreover, command line parameters for currently installed kernels should be checked as well.
Run the following command:
$ sudo grubby --info=ALL | grep args | grep -v 'spec_store_bypass_disable='
The command should not return any output.
      Is it the case that SSB is not configured appropriately?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_redirects
0.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that the command does not return a line, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disallow_bypass_password_sudo_question:question:1">
          <ocil:question_text>Verify the operating system is not configured to bypass password requirements for privilege
escalation. Check the configuration of the "/etc/pam.d/sudo" file with the following command:
$ sudo grep pam_succeed_if /etc/pam.d/sudo
      Is it the case that system is configured to bypass password requirements for privilege escalation?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_sshd_pub_key_question:question:1">
          <ocil:question_text>To check the ownership of /etc/ssh/*.pub,
run the command:
$ ls -lL /etc/ssh/*.pub
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/ssh/*.pub does not have an owner of root?
      </ocil:question_text>
        </ocil:boolean_question>
      </ocil:questions>
    </ocil:ocil>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-ol9-cpe-oval.xml" timestamp="2025-05-05T17:00:00">
    <oval-def:oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
      <oval-def:generator>
        <oval:product_name>build_cpe.py from SCAP Security Guide</oval:product_name>
        <oval:product_version>ssg: [0, 1, 76], python: 3.9.21</oval:product_version>
        <oval:schema_version>5.11</oval:schema_version>
        <oval:timestamp>2025-05-06T00:00:00</oval:timestamp>
      </oval-def:generator>
      <oval-def:definitions>
        <oval-def:definition id="oval:ssg-bootc:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title/>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Bootable container or bootc system</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel is installed" test_ref="oval:ssg-bootc_platform_test_kernel_installed:tst:1"/>
            <oval-def:criterion comment="rpm-ostree is installed" test_ref="oval:ssg-bootc_platform_test_rpm_ostree_installed:tst:1"/>
            <oval-def:criterion comment="bootc is installed" test_ref="oval:ssg-bootc_platform_test_bootc_installed:tst:1"/>
            <oval-def:criterion comment="openshift-kubelet is not installed" test_ref="oval:ssg-bootc_platform_test_openshift_kubelet_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_has_grub2_package:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package grub2 is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:grub2" source="CPE"/>
            <oval-def:description>Checks if package grub2-common is installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Package grub2-common is installed" test_ref="oval:ssg-test_env_has_grub2_installed:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion negate="true" comment="Test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
              <oval-def:criterion negate="true" comment="Test if OPAL is not used" test_ref="oval:ssg-test_system_using_opal:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_has_wifi_interface:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>WiFi interface is present</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:wifi-iface" source="CPE"/>
            <oval-def:description>Checks if any wifi interface is present.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="WiFi interface is present" test_ref="oval:ssg-test_proc_net_wireless_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_is_a_container:def:1" version="2" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a container</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:container" source="CPE"/>
            <oval-def:description>Check for presence of files characterizing container filesystems.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check if /.dockerenv exists" test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1"/>
            <oval-def:criterion comment="Check if /run/.containerenv exists" test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_is_a_machine:def:1" version="2" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a machine</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:machine" source="CPE"/>
            <oval-def:description>Check for absence of files characterizing container filesystems.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition negate="true" comment="If environment is not a container, it is machine" definition_ref="oval:ssg-installed_env_is_a_container:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-nfs_mount_defined:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Remote NFS file system mount is defined</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:nfs_mount_defined" source="CPE"/>
            <oval-def:description>At least one remote NFS file system mount is defined in  /etc/fstab</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="remote nfs filesystem exist" test_ref="oval:ssg-test_nfs_mount_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is aarch64</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel is aarch64</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Architecture is aarch64" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition negate="true" comment="Architecture is not s390x" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-proc_sys_kernel_osrelease_arch_ppc64le:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is ppc64le</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel is ppc64le</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Architecture is ppc64le" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_ppc64le:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel is s390x</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Architecture is s390x" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-proc_sys_kernel_osrelease_arch_x86_64:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is x86_64</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel is x86_64</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Architecture is x86_64" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_x86_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-runtime_kernel_fips_enabled:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Running kernel has fips mode enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:runtime-kernel-fips-enabled" source="CPE"/>
            <oval-def:description>Check if sysctl crypto.fips_enabled = 1</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check if sysctl crypto.fips_enabled = 1" test_ref="oval:ssg-test_runtime_kernel_fips_enabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-selinux_is_enabled:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>SELinux status check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:selinux" source="CPE"/>
            <oval-def:description>Check if System has SELinux enabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="enforce is disabled" test_ref="oval:ssg-test_etc_selinux_configured:tst:1"/>
            <oval-def:criterion comment="/sys/fs/selinux is present" test_ref="oval:ssg-test_selinux_sys_fs_exist:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>SSSD is configured to use LDAP</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:sssd-ldap" source="CPE"/>
            <oval-def:description>Identification provider is not set to ad within /etc/sssd/sssd.conf</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Identification provider is set to ldap within /etc/sssd/sssd.conf" test_ref="oval:ssg-test_id_provider_is_set_to_ldap:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Non-UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:non-uefi" source="CPE"/>
            <oval-def:description>Check if System boot mode is non-UEFI.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition negate="true" comment="Pass if System boot mode is non-UEFI" definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:uefi" source="CPE"/>
            <oval-def:description>Check if system boot mode is UEFI.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check if /sys/firmware/efi folder exists" test_ref="oval:ssg-test_efi_dir_existence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-system_with_kernel:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title/>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel is installed</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel is installed" test_ref="oval:ssg-inventory_test_kernel_installed:tst:1"/>
            <oval-def:criterion comment="kernel-uek is installed" test_ref="oval:ssg-inventory_test_kernel_uek_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_ol9:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 9 System is installed" test_ref="oval:ssg-test_ol9_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is part of the Unix family</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is part of the Unix OS family</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_is_osbuild:def:1" version="2" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Check if the environment is a OSBuild pipeline</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:osbuild" source="CPE"/>
            <oval-def:description>Check the value of environment variable container.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check the value of container variable" test_ref="oval:ssg-test_installed_env_is_osbuild:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-ipv6_enabled:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>IPv6 is enabled on system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="check if ipv6.disable argument is correct in GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_ipv6_disable_is_correct:tst:1"/>
            <oval-def:criterion comment="check if ipv6.disable parameter is defined in /etc/default/grub" test_ref="oval:ssg-test_grub2_ipv6_disable_is_absent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_home:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /home is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /home is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_home_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /home is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_home_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_opt:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /opt is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /opt is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_opt_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /opt is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_opt_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_srv:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /srv is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /srv is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_srv_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /srv is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_srv_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_tmp:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /tmp is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /tmp is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_tmp_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /tmp is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_tmp_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_var-log-audit:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /var/log/audit is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var/log/audit is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_var_log_audit_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var/log/audit is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_var_log_audit_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_var-log:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /var/log is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var/log is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_var_log_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var/log is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_var_log_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_var-tmp:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /var/tmp is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var/tmp is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_var_tmp_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var/tmp is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_var_tmp_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-installed_env_mount_var:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Mountpoint /var is active (mounted) or configured in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var is an active (mounted) mount point" test_ref="oval:ssg-test_mount_active_var_exists:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="The path /var is a mount point configured in /etc/fstab" test_ref="oval:ssg-test_mount_configured_fstab_var_exists:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_ol_gt_or_eq_8_7:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is ol</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Oracle Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Oracle Linux" test_ref="oval:ssg-test_os_id_is_os_linux_ol_gt_or_eq_8_7:tst:1"/>
            <oval-def:criterion comment="The operating system Oracle Linux of version greater than or equal 8.7 is installed" test_ref="oval:ssg-test_os_linux_ol_gt_or_eq_8_7_gt_or_eq_8_7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_ol_gt_or_eq_9:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is ol</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Oracle Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Oracle Linux" test_ref="oval:ssg-test_os_id_is_os_linux_ol_gt_or_eq_9:tst:1"/>
            <oval-def:criterion comment="The operating system Oracle Linux of version greater than or equal 9 is installed" test_ref="oval:ssg-test_os_linux_ol_gt_or_eq_9_gt_or_eq_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_ol_gt_or_eq_9_0:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is ol</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Oracle Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Oracle Linux" test_ref="oval:ssg-test_os_id_is_os_linux_ol_gt_or_eq_9_0:tst:1"/>
            <oval-def:criterion comment="The operating system Oracle Linux of version greater than or equal 9.0 is installed" test_ref="oval:ssg-test_os_linux_ol_gt_or_eq_9_0_gt_or_eq_9_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_rhel_gt_or_eq_8_7:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is rhel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Red Hat Enterprise Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Red Hat Enterprise Linux" test_ref="oval:ssg-test_os_id_is_os_linux_rhel_gt_or_eq_8_7:tst:1"/>
            <oval-def:criterion comment="The operating system Red Hat Enterprise Linux of version greater than or equal 8.7 is installed" test_ref="oval:ssg-test_os_linux_rhel_gt_or_eq_8_7_gt_or_eq_8_7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_rhel_gt_or_eq_9_0:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is rhel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Red Hat Enterprise Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Red Hat Enterprise Linux" test_ref="oval:ssg-test_os_id_is_os_linux_rhel_gt_or_eq_9_0:tst:1"/>
            <oval-def:criterion comment="The operating system Red Hat Enterprise Linux of version greater than or equal 9.0 is installed" test_ref="oval:ssg-test_os_linux_rhel_gt_or_eq_9_0_gt_or_eq_9_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_rhel_le_or_eq_8_4:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is rhel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Red Hat Enterprise Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Red Hat Enterprise Linux" test_ref="oval:ssg-test_os_id_is_os_linux_rhel_le_or_eq_8_4:tst:1"/>
            <oval-def:criterion comment="The operating system Red Hat Enterprise Linux of version less than or equal 8.4 is installed" test_ref="oval:ssg-test_os_linux_rhel_le_or_eq_8_4_le_or_eq_8_4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-os_linux_rhel_ne_9_0:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Operating System is rhel</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The installed operating system is Red Hat Enterprise Linux</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="The operating system installed on the system is Red Hat Enterprise Linux" test_ref="oval:ssg-test_os_id_is_os_linux_rhel_ne_9_0:tst:1"/>
            <oval-def:criterion comment="The operating system Red Hat Enterprise Linux of version not equal 9.0 is installed" test_ref="oval:ssg-test_os_linux_rhel_ne_9_0_ne_9_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_audit:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package audit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audit should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package audit is installed" test_ref="oval:ssg-inventory_test_package_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_autofs:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package autofs is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package autofs should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package autofs is installed" test_ref="oval:ssg-inventory_test_package_autofs_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_avahi:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package avahi is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package avahi should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package avahi is installed" test_ref="oval:ssg-inventory_test_package_avahi_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_bash:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package bash is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package bash should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package bash is installed" test_ref="oval:ssg-inventory_test_package_bash_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_bind:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package bind is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package bind should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package bind is installed" test_ref="oval:ssg-inventory_test_package_bind_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_chrony:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package chrony is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package chrony should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package chrony is installed" test_ref="oval:ssg-inventory_test_package_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_firewalld:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package firewalld is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package firewalld should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package firewalld is installed" test_ref="oval:ssg-inventory_test_package_firewalld_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_gdm:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package gdm is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gdm should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package gdm is installed" test_ref="oval:ssg-inventory_test_package_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_iptables:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package iptables is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package iptables should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package iptables is installed" test_ref="oval:ssg-inventory_test_package_iptables_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_libreswan:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package libreswan is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libreswan should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package libreswan is installed" test_ref="oval:ssg-inventory_test_package_libreswan_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_libuser:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package libuser is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libuser should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package libuser is installed" test_ref="oval:ssg-inventory_test_package_libuser_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_logrotate:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package logrotate is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package logrotate should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package logrotate is installed" test_ref="oval:ssg-inventory_test_package_logrotate_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_net-snmp:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package net-snmp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package net-snmp should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package net-snmp is installed" test_ref="oval:ssg-inventory_test_package_net-snmp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_networkmanager:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package NetworkManager is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package NetworkManager should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package NetworkManager is installed" test_ref="oval:ssg-inventory_test_package_networkmanager_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_nftables:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package nftables is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nftables should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package nftables is installed" test_ref="oval:ssg-inventory_test_package_nftables_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_ntp:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package ntp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package ntp should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package ntp is installed" test_ref="oval:ssg-inventory_test_package_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_pam:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package pam is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package pam should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package pam is installed" test_ref="oval:ssg-inventory_test_package_pam_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_polkit:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package polkit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package polkit should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package polkit is installed" test_ref="oval:ssg-inventory_test_package_polkit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_postfix:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package postfix is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package postfix should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package postfix is installed" test_ref="oval:ssg-inventory_test_package_postfix_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rsh-server:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package rsh-server is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rsh-server should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package rsh-server is installed" test_ref="oval:ssg-inventory_test_package_rsh-server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_rsyslog:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package rsyslog is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rsyslog should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package rsyslog is installed" test_ref="oval:ssg-inventory_test_package_rsyslog_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_shadow-utils:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package shadow-utils is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package shadow-utils should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package shadow-utils is installed" test_ref="oval:ssg-inventory_test_package_shadow-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_snmpd:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package net-snmp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package net-snmp should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package net-snmp is installed" test_ref="oval:ssg-inventory_test_package_snmpd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_squid:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package squid is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package squid should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package squid is installed" test_ref="oval:ssg-inventory_test_package_squid_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_sssd:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package sssd-common is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sssd-common should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package sssd-common is installed" test_ref="oval:ssg-inventory_test_package_sssd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_sudo:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package sudo is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sudo should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package sudo is installed" test_ref="oval:ssg-inventory_test_package_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_systemd:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package systemd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package systemd should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package systemd is installed" test_ref="oval:ssg-inventory_test_package_systemd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_telnet-server:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package telnet-server is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package telnet-server should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package telnet-server is installed" test_ref="oval:ssg-inventory_test_package_telnet-server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_tftp-server:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package tftp-server is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tftp-server should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package tftp-server is installed" test_ref="oval:ssg-inventory_test_package_tftp-server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_ufw:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package ufw is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package ufw should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package ufw is installed" test_ref="oval:ssg-inventory_test_package_ufw_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_usbguard:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package usbguard is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package usbguard should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package usbguard is installed" test_ref="oval:ssg-inventory_test_package_usbguard_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-package_yum:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>Package yum is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package yum should be installed.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Platform package yum is installed" test_ref="oval:ssg-inventory_test_package_yum_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_disabled_firewalld:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>The firewalld is disabled on the system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The firewalld service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package firewalld removed or service firewalld is not configured to start" operator="OR">
            <oval-def:criterion comment="firewalld removed" test_ref="oval:ssg-service_disabled_firewalldtest_service_firewalld_package_firewalld_removed:tst:1"/>
            <oval-def:criteria comment="service firewalld is not configured to start" operator="AND">
              <oval-def:criterion comment="firewalld is not running" test_ref="oval:ssg-test_service_not_running_service_disabled_firewalld_firewalld:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service firewalld is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_disabled_firewalld_firewalld:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_disabled_iptables:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>The iptables is disabled on the system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The iptables service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package iptables removed or service iptables is not configured to start" operator="OR">
            <oval-def:criterion comment="iptables removed" test_ref="oval:ssg-service_disabled_iptablestest_service_iptables_package_iptables_removed:tst:1"/>
            <oval-def:criteria comment="service iptables is not configured to start" operator="AND">
              <oval-def:criterion comment="iptables is not running" test_ref="oval:ssg-test_service_not_running_service_disabled_iptables_iptables:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service iptables is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_disabled_iptables_iptables:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-service_disabled_ufw:def:1" version="1" class="inventory">
          <oval-def:metadata>
            <oval-def:title>The ufw is disabled on the system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Oracle Linux 9</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ufw service should be disabled.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="package ufw removed or service ufw is not configured to start" operator="OR">
            <oval-def:criterion comment="ufw removed" test_ref="oval:ssg-service_disabled_ufwtest_service_ufw_package_ufw_removed:tst:1"/>
            <oval-def:criteria comment="service ufw is not configured to start" operator="AND">
              <oval-def:criterion comment="ufw is not running" test_ref="oval:ssg-test_service_not_running_service_disabled_ufw_ufw:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service ufw is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_service_disabled_ufw_ufw:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
      </oval-def:definitions>
      <oval-def:tests>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_kernel_installed:tst:1" version="1" check="all" comment="package kernel is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_kernel_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_rpm_ostree_installed:tst:1" version="1" check="all" comment="package rpm-ostree is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_rpm_ostree_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_bootc_installed:tst:1" version="1" check="all" comment="package bootc is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_bootc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-bootc_platform_test_openshift_kubelet_removed:tst:1" version="1" check="all" comment="package openshift-kubelet is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_bootc_platform_test_openshift_kubelet_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" comment="system has package grub2-common installed" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test id="oval:ssg-test_system_using_opal:tst:1" version="1" check="all" comment="Check if /sys/firmware/opal exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_proc_net_wireless_exists:tst:1" version="1" check="all" comment="Test if /proc/net/wireless exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_proc_net_wireless_exists:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check="all" comment="Check if /.dockerenv exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check="all" comment="Check if /run/.containerenv exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nfs_mount_exists:tst:1" version="1" check="all" comment="at least one nfs is defined" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_nfs_mount_defined:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_aarch64:tst:1" version="1" check="all" comment="proc_sys_kernel is for aarch64 architecture" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_ppc64le:tst:1" version="1" check="all" comment="proc_sys_kernel is for ppc64le architecture" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_ppc64le:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check="all" comment="proc_sys_kernel is for s390x architecture" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_x86_64:tst:1" version="1" check="all" comment="proc_sys_kernel is for x86_64 architecture" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_x86_64:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test id="oval:ssg-test_runtime_kernel_fips_enabled:tst:1" version="1" check="all" comment="kernel runtime parameter crypto.fips_enabled set to 1" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-obj_runtime_kernel_fips_enabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_runtime_kernel_fips_enabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test id="oval:ssg-test_etc_selinux_configured:tst:1" version="1" check="all" comment="/selinux/enforce is 1" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_etc_selinux_configured:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_selinux_configured:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_selinux_sys_fs_exist:tst:1" version="1" check="all" comment="check if /sys/fs/selinux exists" check_existence="all_exist" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_selinux_sys_fs_exist:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_id_provider_is_set_to_ldap:tst:1" version="1" check="all" comment="SSSD Configuration is set to use LDAP" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_id_provider_is_set_to_ldap:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" comment="Verify if /sys/firmware/efi folder exists" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_kernel_installed:tst:1" version="1" check="all" comment="package kernel is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_kernel_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_kernel_uek_installed:tst:1" version="1" check="all" comment="package kernel-uek is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_kernel_uek_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-test_ol9_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 9" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_ol9_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol9_system:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_unix_family:tst:1" version="1" check="all" comment="Test installed OS is part of the unix family" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
        </ind:family_test>
        <ind:environmentvariable58_test id="oval:ssg-test_installed_env_is_osbuild:tst:1" version="1" check="all" comment="environment variable container is set to bwrap-osbuild" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_installed_env_is_osbuild:obj:1"/>
          <ind:state state_ref="oval:ssg-state_installed_env_is_osbuild:ste:1"/>
        </ind:environmentvariable58_test>
        <unix:uname_test id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" comment="64 bit architecture" state_operator="AND">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
        </unix:uname_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_is_correct:tst:1" version="1" check="all" comment="check GRUB_CMDLINE_LINUX parameters in /etc/default/grub" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_ipv6_disable_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_is_absent:tst:1" version="1" check="all" comment="ipv6.disable is not defined in /etc/default/grub" check_existence="none_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_grub2_ipv6_disable_parameter:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_home_exists:tst:1" version="1" check="all" comment="Mountpoint /home exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_home_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_home_exists:tst:1" version="1" check="all" comment="Mountpoint /home is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_home_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_opt_exists:tst:1" version="1" check="all" comment="Mountpoint /opt exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_opt_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_opt_exists:tst:1" version="1" check="all" comment="Mountpoint /opt is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_opt_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_srv_exists:tst:1" version="1" check="all" comment="Mountpoint /srv exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_srv_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_srv_exists:tst:1" version="1" check="all" comment="Mountpoint /srv is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_srv_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_tmp_exists:tst:1" version="1" check="all" comment="Mountpoint /tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_tmp_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_tmp_exists:tst:1" version="1" check="all" comment="Mountpoint /tmp is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_tmp_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_var_log_audit_exists:tst:1" version="1" check="all" comment="Mountpoint /var/log/audit exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_var_log_audit_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_var_log_audit_exists:tst:1" version="1" check="all" comment="Mountpoint /var/log/audit is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_var_log_audit_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_var_log_exists:tst:1" version="1" check="all" comment="Mountpoint /var/log exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_var_log_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_var_log_exists:tst:1" version="1" check="all" comment="Mountpoint /var/log is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_var_log_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_var_tmp_exists:tst:1" version="1" check="all" comment="Mountpoint /var/tmp exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_var_tmp_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_var_tmp_exists:tst:1" version="1" check="all" comment="Mountpoint /var/tmp is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_var_tmp_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_active_var_exists:tst:1" version="1" check="all" comment="Mountpoint /var exists" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-object_mount_active_var_exists:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_mount_configured_fstab_var_exists:tst:1" version="1" check="all" comment="Mountpoint /var is configured" check_existence="all_exist" state_operator="AND">
          <ind:object object_ref="oval:ssg-object_mount_configured_fstab_var_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_ol_gt_or_eq_8_7:tst:1" version="1" check="all" comment="ID in os-release is ol" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_ol_gt_or_eq_8_7:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_ol_gt_or_eq_8_7:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_ol_gt_or_eq_8_7_gt_or_eq_8_7:tst:1" version="1" check="all" comment="VERSION_ID in os-release is greater than or equal 8.7" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_ol_gt_or_eq_8_7_gt_or_eq_8_7:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_ol_gt_or_eq_8_7_gt_or_eq_8_7:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_ol_gt_or_eq_9:tst:1" version="1" check="all" comment="ID in os-release is ol" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_ol_gt_or_eq_9:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_ol_gt_or_eq_9:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_ol_gt_or_eq_9_gt_or_eq_9:tst:1" version="1" check="all" comment="VERSION_ID in os-release is greater than or equal 9" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_ol_gt_or_eq_9_gt_or_eq_9:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_ol_gt_or_eq_9_gt_or_eq_9:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_ol_gt_or_eq_9_0:tst:1" version="1" check="all" comment="ID in os-release is ol" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_ol_gt_or_eq_9_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_ol_gt_or_eq_9_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_ol_gt_or_eq_9_0_gt_or_eq_9_0:tst:1" version="1" check="all" comment="VERSION_ID in os-release is greater than or equal 9.0" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_ol_gt_or_eq_9_0_gt_or_eq_9_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_ol_gt_or_eq_9_0_gt_or_eq_9_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_rhel_gt_or_eq_8_7:tst:1" version="1" check="all" comment="ID in os-release is rhel" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_rhel_gt_or_eq_8_7:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_rhel_gt_or_eq_8_7:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_rhel_gt_or_eq_8_7_gt_or_eq_8_7:tst:1" version="1" check="all" comment="VERSION_ID in os-release is greater than or equal 8.7" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_rhel_gt_or_eq_8_7_gt_or_eq_8_7:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_rhel_gt_or_eq_8_7_gt_or_eq_8_7:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_rhel_gt_or_eq_9_0:tst:1" version="1" check="all" comment="ID in os-release is rhel" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_rhel_gt_or_eq_9_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_rhel_gt_or_eq_9_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_rhel_gt_or_eq_9_0_gt_or_eq_9_0:tst:1" version="1" check="all" comment="VERSION_ID in os-release is greater than or equal 9.0" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_rhel_gt_or_eq_9_0_gt_or_eq_9_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_rhel_gt_or_eq_9_0_gt_or_eq_9_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_rhel_le_or_eq_8_4:tst:1" version="1" check="all" comment="ID in os-release is rhel" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_rhel_le_or_eq_8_4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_rhel_le_or_eq_8_4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_rhel_le_or_eq_8_4_le_or_eq_8_4:tst:1" version="1" check="all" comment="VERSION_ID in os-release is less than or equal 8.4" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_rhel_le_or_eq_8_4_le_or_eq_8_4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_rhel_le_or_eq_8_4_le_or_eq_8_4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_id_is_os_linux_rhel_ne_9_0:tst:1" version="1" check="all" comment="ID in os-release is rhel" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_id_is_os_linux_rhel_ne_9_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_id_is_os_linux_rhel_ne_9_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_os_linux_rhel_ne_9_0_ne_9_0:tst:1" version="1" check="all" comment="VERSION_ID in os-release is not equal 9.0" state_operator="AND">
          <ind:object object_ref="oval:ssg-obj_os_linux_rhel_ne_9_0_ne_9_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_os_linux_rhel_ne_9_0_ne_9_0:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_audit_installed:tst:1" version="1" check="all" comment="package audit is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_autofs_installed:tst:1" version="1" check="all" comment="package autofs is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_autofs_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_avahi_installed:tst:1" version="1" check="all" comment="package avahi is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_avahi_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_bash_installed:tst:1" version="1" check="all" comment="package bash is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_bash_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_bind_installed:tst:1" version="1" check="all" comment="package bind is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_bind_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_chrony_installed:tst:1" version="1" check="all" comment="package chrony is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_firewalld_installed:tst:1" version="1" check="all" comment="package firewalld is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_firewalld_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_gdm_installed:tst:1" version="1" check="all" comment="package gdm is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_iptables_installed:tst:1" version="1" check="all" comment="package iptables is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_iptables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_libreswan_installed:tst:1" version="1" check="all" comment="package libreswan is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_libreswan_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_libuser_installed:tst:1" version="1" check="all" comment="package libuser is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_libuser_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_logrotate_installed:tst:1" version="1" check="all" comment="package logrotate is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_logrotate_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_net-snmp_installed:tst:1" version="1" check="all" comment="package net-snmp is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_net-snmp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_networkmanager_installed:tst:1" version="1" check="all" comment="package NetworkManager is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_networkmanager_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_nftables_installed:tst:1" version="1" check="all" comment="package nftables is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_nftables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_ntp_installed:tst:1" version="1" check="all" comment="package ntp is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_pam_installed:tst:1" version="1" check="all" comment="package pam is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_pam_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_polkit_installed:tst:1" version="1" check="all" comment="package polkit is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_polkit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_postfix_installed:tst:1" version="1" check="all" comment="package postfix is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_rsh-server_installed:tst:1" version="1" check="all" comment="package rsh-server is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_rsh-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_rsyslog_installed:tst:1" version="1" check="all" comment="package rsyslog is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_shadow-utils_installed:tst:1" version="1" check="all" comment="package shadow-utils is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_shadow-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_snmpd_installed:tst:1" version="1" check="all" comment="package net-snmp is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_snmpd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_squid_installed:tst:1" version="1" check="all" comment="package squid is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_squid_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_sssd_installed:tst:1" version="1" check="all" comment="package sssd-common is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_sssd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_sudo_installed:tst:1" version="1" check="all" comment="package sudo is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_systemd_installed:tst:1" version="1" check="all" comment="package systemd is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_systemd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_telnet-server_installed:tst:1" version="1" check="all" comment="package telnet-server is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_telnet-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_tftp-server_installed:tst:1" version="1" check="all" comment="package tftp-server is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_tftp-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_ufw_installed:tst:1" version="1" check="all" comment="package ufw is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_ufw_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_usbguard_installed:tst:1" version="1" check="all" comment="package usbguard is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test id="oval:ssg-inventory_test_package_yum_installed:tst:1" version="1" check="all" comment="package yum is installed" check_existence="all_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_inventory_test_package_yum_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_disabled_firewalld_firewalld:tst:1" version="1" check="all" comment="Test that the firewalld service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_disabled_firewalld_firewalld:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_disabled_firewalld_firewalld:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_disabled_firewalld_firewalld:tst:1" version="1" check="all" comment="Test that the property LoadState from the service firewalld is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_disabled_firewalld_firewalld:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_disabled_firewalld_firewalld:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_disabled_firewalldtest_service_firewalld_package_firewalld_removed:tst:1" version="1" check="all" comment="package firewalld is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_disabled_firewalldtest_service_firewalld_package_firewalld_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_disabled_iptables_iptables:tst:1" version="1" check="all" comment="Test that the iptables service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_disabled_iptables_iptables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_disabled_iptables_iptables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_disabled_iptables_iptables:tst:1" version="1" check="all" comment="Test that the property LoadState from the service iptables is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_disabled_iptables_iptables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_disabled_iptables_iptables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_disabled_iptablestest_service_iptables_package_iptables_removed:tst:1" version="1" check="all" comment="package iptables is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_disabled_iptablestest_service_iptables_package_iptables_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_service_disabled_ufw_ufw:tst:1" version="1" check="all" comment="Test that the ufw service is not running" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_not_running_service_disabled_ufw_ufw:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_service_disabled_ufw_ufw:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_service_disabled_ufw_ufw:tst:1" version="1" check="all" comment="Test that the property LoadState from the service ufw is masked" check_existence="any_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_service_disabled_ufw_ufw:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_service_disabled_ufw_ufw:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test id="oval:ssg-service_disabled_ufwtest_service_ufw_package_ufw_removed:tst:1" version="1" check="all" comment="package ufw is removed" check_existence="none_exist" state_operator="AND">
          <linux:object object_ref="oval:ssg-obj_service_disabled_ufwtest_service_ufw_package_ufw_removed:obj:1"/>
        </linux:rpminfo_test>
      </oval-def:tests>
      <oval-def:objects>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_kernel_installed:obj:1" version="1">
          <linux:name>kernel</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_rpm_ostree_installed:obj:1" version="1">
          <linux:name>rpm-ostree</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_bootc_installed:obj:1" version="1">
          <linux:name>bootc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_bootc_platform_test_openshift_kubelet_removed:obj:1" version="1">
          <linux:name>openshift-kubelet</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
          <linux:name>grub2-common</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
          <unix:filepath>/sys/firmware/opal</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_proc_net_wireless_exists:obj:1" version="1" comment="/proc/net/wireless file">
          <unix:filepath>/proc/net/wireless</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" comment="Check file /.dockerenv">
          <unix:filepath datatype="string">/.dockerenv</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" comment="Check file /run/.containerenv">
          <unix:filepath datatype="string">/run/.containerenv</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nfs_mount_defined:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[?[\.\w:-]+\]?[:=][/\w-]+\s+[/\w\\-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_aarch64:obj:1" version="1">
          <ind:filepath operation="pattern match">/proc/sys/kernel/(osrelease|arch)</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.aarch64$|^aarch64$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_ppc64le:obj:1" version="1">
          <ind:filepath operation="pattern match">/proc/sys/kernel/(osrelease|arch)</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.ppc64le$|^ppc64le$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
          <ind:filepath operation="pattern match">/proc/sys/kernel/(osrelease|arch)</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.s390x$|^s390x$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_x86_64:obj:1" version="1">
          <ind:filepath operation="pattern match">/proc/sys/kernel/(osrelease|arch)</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.x86_64$|^x86_64$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-obj_runtime_kernel_fips_enabled:obj:1" version="1">
          <unix:name>crypto.fips_enabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_selinux_configured:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_selinux_sys_fs_exist:obj:1" version="1" comment="/sys/fs/selinux">
          <unix:path>/sys/fs/selinux</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ldap:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ldap)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1" comment="/sys/firmware/efi">
          <unix:path>/sys/firmware/efi</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_kernel_installed:obj:1" version="1">
          <linux:name>kernel</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_kernel_uek_installed:obj:1" version="1">
          <linux:name>kernel-uek</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol9_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
        <ind:environmentvariable58_object id="oval:ssg-object_installed_env_is_osbuild:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>container</ind:name>
        </ind:environmentvariable58_object>
        <unix:uname_object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" comment="64 bit architecture"/>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_parameter:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX=".*ipv6\.disable=(\d).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_home_exists:obj:1" version="1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_home_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/home[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_opt_exists:obj:1" version="1">
          <linux:mount_point>/opt</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_opt_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/opt[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_srv_exists:obj:1" version="1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_srv_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/srv[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_tmp_exists:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_tmp_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_var_log_audit_exists:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_var_log_audit_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/var/log/audit[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_var_log_exists:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_var_log_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/var/log[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_var_tmp_exists:obj:1" version="1">
          <linux:mount_point>/var/tmp</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_var_tmp_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/var/tmp[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_active_var_exists:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_mount_configured_fstab_var_exists:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+/var[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_ol_gt_or_eq_8_7:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_ol_gt_or_eq_8_7_gt_or_eq_8_7:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_ol_gt_or_eq_9:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_ol_gt_or_eq_9_gt_or_eq_9:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_ol_gt_or_eq_9_0:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_ol_gt_or_eq_9_0_gt_or_eq_9_0:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_rhel_gt_or_eq_8_7:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_rhel_gt_or_eq_8_7_gt_or_eq_8_7:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_rhel_gt_or_eq_9_0:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_rhel_gt_or_eq_9_0_gt_or_eq_9_0:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_rhel_le_or_eq_8_4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_rhel_le_or_eq_8_4_le_or_eq_8_4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_id_is_os_linux_rhel_ne_9_0:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID=["']?(\w+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_os_linux_rhel_ne_9_0_ne_9_0:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID=["']?([\w.]+)["']?$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_autofs_installed:obj:1" version="1">
          <linux:name>autofs</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_avahi_installed:obj:1" version="1">
          <linux:name>avahi</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_bash_installed:obj:1" version="1">
          <linux:name>bash</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_bind_installed:obj:1" version="1">
          <linux:name>bind</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_firewalld_installed:obj:1" version="1">
          <linux:name>firewalld</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_iptables_installed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_libreswan_installed:obj:1" version="1">
          <linux:name>libreswan</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_libuser_installed:obj:1" version="1">
          <linux:name>libuser</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_logrotate_installed:obj:1" version="1">
          <linux:name>logrotate</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_net-snmp_installed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_networkmanager_installed:obj:1" version="1">
          <linux:name>NetworkManager</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_nftables_installed:obj:1" version="1">
          <linux:name>nftables</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_pam_installed:obj:1" version="1">
          <linux:name>pam</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_polkit_installed:obj:1" version="1">
          <linux:name>polkit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_rsh-server_installed:obj:1" version="1">
          <linux:name>rsh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_shadow-utils_installed:obj:1" version="1">
          <linux:name>shadow-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_snmpd_installed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_squid_installed:obj:1" version="1">
          <linux:name>squid</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_sssd_installed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_systemd_installed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_telnet-server_installed:obj:1" version="1">
          <linux:name>telnet-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_tftp-server_installed:obj:1" version="1">
          <linux:name>tftp-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_ufw_installed:obj:1" version="1">
          <linux:name>ufw</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_inventory_test_package_yum_installed:obj:1" version="1">
          <linux:name>yum</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_disabled_firewalld_firewalld:obj:1" version="1" comment="Retrieve the ActiveState property of firewalld">
          <linux:unit operation="pattern match">^firewalld\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_disabled_firewalld_firewalld:obj:1" version="1" comment="Retrieve the LoadState property of firewalld">
          <linux:unit operation="pattern match">^firewalld\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_disabled_firewalldtest_service_firewalld_package_firewalld_removed:obj:1" version="1">
          <linux:name>firewalld</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_disabled_iptables_iptables:obj:1" version="1" comment="Retrieve the ActiveState property of iptables">
          <linux:unit operation="pattern match">^iptables\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_disabled_iptables_iptables:obj:1" version="1" comment="Retrieve the LoadState property of iptables">
          <linux:unit operation="pattern match">^iptables\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_disabled_iptablestest_service_iptables_package_iptables_removed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_service_disabled_ufw_ufw:obj:1" version="1" comment="Retrieve the ActiveState property of ufw">
          <linux:unit operation="pattern match">^ufw\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_service_disabled_ufw_ufw:obj:1" version="1" comment="Retrieve the LoadState property of ufw">
          <linux:unit operation="pattern match">^ufw\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_service_disabled_ufwtest_service_ufw_package_ufw_removed:obj:1" version="1">
          <linux:name>ufw</linux:name>
        </linux:rpminfo_object>
      </oval-def:objects>
      <oval-def:states>
        <unix:sysctl_state id="oval:ssg-state_runtime_kernel_fips_enabled:ste:1" version="1" operator="AND">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_selinux_configured:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="string" operation="pattern match">^(enforcing|permissive)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_ol9_system:ste:1" version="1" operator="AND">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1" operator="AND">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:environmentvariable58_state id="oval:ssg-state_installed_env_is_osbuild:ste:1" version="1" operator="AND">
          <ind:value>bwrap-osbuild</ind:value>
        </ind:environmentvariable58_state>
        <unix:uname_state id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1" operator="AND" comment="64 bit architecture">
          <unix:processor_type operation="equals">ppc64le</unix:processor_type>
        </unix:uname_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_ipv6_disable_argument:ste:1" version="1" operator="AND">
          <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_ol_gt_or_eq_8_7:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">ol</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_ol_gt_or_eq_8_7_gt_or_eq_8_7:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" datatype="version">8.7</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_ol_gt_or_eq_9:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">ol</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_ol_gt_or_eq_9_gt_or_eq_9:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" datatype="version">9</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_ol_gt_or_eq_9_0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">ol</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_ol_gt_or_eq_9_0_gt_or_eq_9_0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" datatype="version">9.0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_rhel_gt_or_eq_8_7:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">rhel</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_rhel_gt_or_eq_8_7_gt_or_eq_8_7:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" datatype="version">8.7</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_rhel_gt_or_eq_9_0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">rhel</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_rhel_gt_or_eq_9_0_gt_or_eq_9_0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="greater than or equal" datatype="version">9.0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_rhel_le_or_eq_8_4:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">rhel</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_rhel_le_or_eq_8_4_le_or_eq_8_4:ste:1" version="1" operator="AND">
          <ind:subexpression operation="less than or equal" datatype="version">8.4</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_id_is_os_linux_rhel_ne_9_0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="pattern match">rhel</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_os_linux_rhel_ne_9_0_ne_9_0:ste:1" version="1" operator="AND">
          <ind:subexpression operation="not equal" datatype="version">9.0</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_disabled_firewalld_firewalld:ste:1" version="1" operator="AND" comment="firewalld is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_disabled_firewalld_firewalld:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_disabled_iptables_iptables:ste:1" version="1" operator="AND" comment="iptables is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_disabled_iptables_iptables:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_service_disabled_ufw_ufw:ste:1" version="1" operator="AND" comment="ufw is not running">
          <linux:value operation="pattern match">inactive|failed</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_service_disabled_ufw_ufw:ste:1" version="1" operator="AND" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
      </oval-def:states>
    </oval-def:oval_definitions>
  </ds:component>
</ds:data-stream-collection>
